Advanced Specialist, Security Engineer

Pearson’s Sovereign Team is its technical cybersecurity team supporting business units with sovereign contractual and regulatory requirements. The Security Engineer validates regulated architecture, designs and operates security tooling, and leads technical assurance, audit readiness, and engineering enablement without people-management responsibilities.

Responsibilities:

• Conduct readiness assessments for business units entering regulated or sovereign environments; review authorization boundaries and data flows
• Identify architectural blockers early across identity, cloud, application, logging and data controls
• Validate that proposed tools and services are suitable for the applicable boundary — and escalate where they are not
• Translate regulatory and contractual requirements into concrete technical designs, standards and hardening guidance
• Lead paved road tool selection, design and onboarding for regulated environments
• Define sovereign requirements for enterprise operated tooling, validate suitability, and coordinate with the enterprise owners who run the platforms
• Design and support boundary critical capability such as identity, WAF, DSPM and logging/SIEM architecture
• Identify and automate opportunities to reduce manual control validation and evidence gathering
• Ability to create scripts to support FedRAMP 20x to automate governance and compliance measurements for Rules and KSIs
• Own vulnerability and control health oversight across the sovereign estate, escalating risk trends and missed remediation commitments to the right owner
• Provide penetration test scope assurance and cadence support, including annual IT Health Check and ATO cycles
• Lead technical audit preparation and evidence quality review; support POA&M, KEV and STIG activity
• Interface directly with 3PAOs, external assessors and government customers on technical control questions
• Provide oversight, direction and advice to cybersecurity engineers by reviewing security designs and implementations
• Mentor and develop engineers on sovereign requirements, secure architecture and secure SDLC practice
• Build reusable playbooks, standards and onboarding material so team capability scales beyond individuals
• Serve as a single technical entry point for business units at project intake, security kickoff and tool onboarding
• Contribute to budget, licensing and vendor conversations, and communicate technical risk clearly to senior leadership

Requirements:

• Bachelor's degree in computer science, Information Security, MIS or an equivalent technical discipline
• Significant hands-on experience in cloud and infrastructure security engineering, at a senior or lead level
• Demonstrable experience operating within a regulated or accredited environment — FedRAMP, GovRAMP, NIST SP 80053, ISO27001, or a comparable national scheme
• Strong practical cloud security depth in Azure, GCP and AWS, including boundary design, network segmentation, hardening and identity
• Experience defining and evidencing technical controls for external audit and engaging directly with assessors
• Working fluency in application security and secure SDLC — SAST/SCA/RASP tooling, vulnerability triage, and credible engagement with development teams
• Experience with SIEM, logging and alerting platforms and their integration into a monitored boundary
• Ability to script and automate (Python or comparable) to reduce manual control and evidence work
• Excellent written and verbal communication; able to explain technical risk to nontechnical and executive audiences
• Direct experience preparing for or maintaining a FedRAMP or GovRAMP authorization
• Familiarity with additional sovereign regimes — UK Cyber Essentials Plus / NCSC, EU GDPR and NIS2, China MLPS/PIPL, Saudi NCA ECC, Australia ASD Essential Eight
• Experience supporting government or public-sector customers under contractual security obligations
• Vulnerability management and posture management tooling at enterprise scale
• Experience with CI/CD pipelines and infrastructure as code in a regulated context
• Professional accreditation such as CISSP, CISM, CCSP or equivalent
• Prior experience mentoring engineers or leading a small technical function
• Comfort operating in an agile environment with shifting priorities and multiple concurrent regulatory deadlines