About the role

Position: Senior Azure Databricks Platform Security Engineer

Reporting to: Head – Security Engineering

Grade / Level: Manager – Individual Contributor

Work Location: Navi Mumbai, Maharashtra

Experience: 6–9 years in Azure cloud security and data platform security, with hands-on Azure Databricks exposure

Qualification: BE / B.Tech / MCA or equivalent in Computer Science, IT, or Cybersecurity

Desirable Certification: AZ-500: Microsoft Azure Security Technologies / Databricks Certified Data Engineer Associate / SC-200: Microsoft Security Operations Analyst /AZ-700: Designing and Implementing Azure Networking Solutions

Key Focus Area: Azure Databricks Security, Unity Catalog, Lakehouse Data Protection, Azure Cloud Tenant Security Controls, Sentinel Detections for Databricks.

Key Responsibilities:

Azure Databricks Platform Security & Unity Catalog

· Harden Azure Databricks workspaces – VNet injection, Secure Cluster Connectivity, Private Link, customer-managed keys, and PAT/Service Principal governance.

· Configure Unity Catalog – metastore, catalogs, schemas, external locations, storage credentials, and row/column-level access controls

· Define cluster policies, init-script controls, secret scopes (Azure Key Vault-backed), and library allow-lists.

· Audit access to ADLS Gen2, Delta Lake, and external data sources; enforce encryption-at-rest with CMK and Private Endpoint connectivity.

B. Azure Cloud Tenant Security Controls

Configure Microsoft Entra ID controls supporting Databricks – Conditional Access, MFA, and SCIM provisioning.
Operate Azure PIM for Databricks workspace and resource-group roles; run periodic access reviews.
Apply Azure Policy initiatives to Databricks deployments – VNet injection, public access disabled, CMK, diagnostics.

C. Sentinel Detections for Databricks

Onboard Databricks diagnostic logs (workspace, cluster, jobs, secrets, SQL, Unity Catalog) into Log Analytics / Sentinel.
Build Sentinel Analytics Rules and Workbooks for Databricks-specific threats – PAT abuse, init-script tampering, cluster-policy bypass, and Unity Catalog grant changes.
Author Logic Apps playbooks for token revocation, ITSM ticketing, and Teams/email notifications.