Data security is non-negotiable:
IAM (Identity and Access Management):
- Least privilege: Grant minimum permissions needed
- Roles over users: Assign permissions to roles, then roles to users
- Service accounts: Pipelines use dedicated identities, not personal credentials
Data protection:
- Encryption at rest: S3, GCS, BigQuery all encrypt by default
- Encryption in transit: TLS for all connections
- Column-level security: Mask PII from unauthorized users
- Audit logging: Track who accessed what data
You'll be asked: "How would you secure sensitive data?" Know these patterns.