DATA ENGINEER

Platform Overview

• Globus SaaS control plane with user authentication via Entra  (restricted to allowed identity providers: mayo.edu, globus.org, approved external institutions)
• Two internally hosted Compute Engine VMs running Globus Connect Server (GCS v5) in the GCP Data DMZ
• GCP ingress and egress S3 storage buckets with a defined 30-day data lifecycle/retention rule
• GridFTP parallel transfer protocol across HTTPS 443 and TCP ports 50000–51000 for high-performance data movement
• Globus Storage Gateways (Google S3 connectors) linking collections to GCP bucket storage
• Data movement performed by Globus-managed service accounts — no direct user access to underlying buckets
• User provisioning managed via Sailpoint
• Flat-fee licensing model for unlimited data transfer and unlimited endpoints (cloud and on-premises)

The contractor will be responsible for, but not limited to, the following:

• Complete final configuration and hardening of the Globus Connect Server (GCS v5) deployment on GCP Compute Engine VMs within the Data DMZ
• Configure and validate Globus Storage Gateways and S3 Storage Connectors for ingress and egress GCP buckets
• Configure Globus collections (Managed and Guest) aligned with Mayo's data access policies and identity provider restrictions
• Validate end-to-end data transfer workflows including ingress, egress, and staging collection transfers across the Service Connector (SC) boundary into the MCC VPC
• Configure DNS, authentication flows (OAuth/OpenID Connect via Entra ), and endpoint registration within Globus.org

• Onboard initial research user groups to the Globus platform, providing hands‑on support for first transfers
• Develop and document standardized user onboarding procedures, including Sailpoint provisioning workflows and Globus Web App access
• Provide Tier 1/2 operational support for Globus users — troubleshooting transfer failures, stalled transfers, permission issues, connectivity problems, and performance optimization
• Coordinate with Globus vendor support (University of Chicago) for escalated issues using the established Globus support process

• Monitor and maintain Globus Connect Server VM health, GCS services, and GCP bucket lifecycle policies
• Manage Globus endpoint configurations including storage gateways, identity provider settings, path restrictions, and access policies
• Perform ongoing performance tuning — optimizing GridFTP concurrency, parallelism, data channel configurations, and transfer parameters for high‑throughput workloads
• Monitor transfer activity, usage patterns, and audit logs for operational and compliance reporting
• Manage GCS software updates, patches, and version upgrades
• Support disaster recovery planning and testing for the Globus platform

• Implement and enforce security controls aligned with Mayo Clinic ISA, BAA, and NIST frameworks
• Manage identity provider configurations and access controls (RBAC) within the Globus platform
• Ensure data governance policies are enforced — including collection‑level permissions, path restrictions, and transfer audit logging
• Support TPRM and Risk/OIS requirements as they relate to Globus operations

• Produce comprehensive technical documentation: runbooks, SOPs, architecture diagrams, troubleshooting guides, and operational playbooks
• Participate in the Globus Orientation Session led by Pete Eby from the Architecture team and help translate session content into operational procedures
• Transfer knowledge to Mayo Clinic Enterprise Interfaces staff to enable long‑term self‑sufficiency
• Document lessons learned from initial user onboarding and operational support activities

• Navigate Mayo Clinic governance, change management, and approval processes for platform changes
• Collaborate with the Architecture team, Storage/Infrastructure team, and Research stakeholders
• Coordinate with ADO repo owners for configuration and state management
• Provide input into long‑term MFT operations planning and AI‑operations integration

• 3+…