Advanced Specialist, Security Engineer

Pearson; Durham (NC); Hybrid; USD 80,000 - 125,000; Full time

Job summary

Pearson’s Sovereign Team leads our cloud, infrastructure and application security to meet global sovereign requirements. As a Security Engineer you will own technical direction, validate architectures, and mentor engineers in secure practices and governance for regulated environments.

You will collaborate with 3PAOs, external assessors and government customers, shaping tooling and controls while contributing to budget and vendor discussions.

Qualifications

• Significant hands-on experience in cloud and infrastructure security engineering at a senior/lead level.
• Experience in regulated/accredited environments (FedRAMP, GovRAMP, NIST SP 800-53, ISO27001).
• Strong ability to script and automate (Python) and to engage with auditors.

Responsibilities

• Lead sovereign architecture and readiness efforts for regulated environments.
• Design and operate security tooling across identity, WAF, DSPM and logging/SIEM.
• Oversee continuous assurance, vendor and audit readiness, and collaboration with 3PAOs and government customers.
• Mentor engineers on sovereign requirements and secure SDLC practices.

Skills

Cloud security

Architecture design

Regulatory compliance

Python scripting

Audits coordination

Executive communication

Education

Bachelor’s degree in Computer Science or related

Tools

Azure

AWS

GCP

Job description

Summary

The Sovereign Team is the technical cybersecurity team of Pearson’s cybersecurity organization that works with the Lines of Business on contractual and regulatory obligations as it relates to sovereign requirements from countries around the world. We are not compliance or audit function — we are the deep technical experts on cloud, infrastructure and application security who hold the architectural knowledge that makes certifications such as FedRAMP, GovRAMP and Cyber Essentials Plus achievable and defensible.

As a Security Engineer, you will be a senior hands‑on practitioner and technical individual contributor within the team, leading your own efforts. You will validate that architecture is actually deployed correctly against each sovereign requirement, design and operate the security tooling that underpins regulated boundaries, and provide oversight, direction and mentorship to engineers across the team. You will be expected to represent the team credibly with business units, enterprise security teams, external auditors and government customers — and to carry senior‑level conversations, including budget and vendor discussions.

This is a technical role with leadership responsibility. It is not a people‑management role, but you will set technical direction, mentor engineers, and act as the escalation point for complex sovereign security problems.

Key Responsibilities

Sovereign architecture & readiness

• Conduct readiness assessments for business units entering regulated or sovereign environments; review authorization boundaries and data flows.
• Identify architectural blockers early across identity, cloud, application, logging and data controls.
• Validate that proposed tools and services are suitable for the applicable boundary — and elevate where they are not.
• Translate regulatory and contractual requirements into concrete technical designs, standards and hardening guidance.

Security engineering & approved tooling

• Lead paved road tool selection, design and onboarding for regulated environments.
• Define sovereign requirements for enterprise operated tooling, validate suitability, and coordinate with the enterprise owners who run the platforms.
• Design and support boundary critical capability such as identity, WAF, DSPM and logging/SIEM architecture.
• Identify and automate opportunities to reduce manual control validation and evidence gathering.
• Ability to create scripts to support FedRAMP 20x to automate governance and compliance measurements for Rules and KSIs

Continuous assurance & authorization maintenance

• Own vulnerability and control health oversight across the sovereign estate, escalating risk trends and missed remediation commitments to the right owner.
• Provide penetration test scope assurance and cadence support, including annual IT Health Check and ATO cycles.
• Lead technical audit preparation and evidence quality review; support POA&M, KEV and STIG activity.
• Interface directly with 3PAOs, external assessors and government customers on technical control questions.
• Technical leadership & enablement
• Provide oversight, direction and advice to cybersecurity engineers by reviewing security designs and implementations.
• Mentor and develop engineers on sovereign requirements, secure architecture and secure SDLC practice.
• Build reusable playbooks, standards and onboarding material so team capability scales beyond individuals.
• Serve as a single technical entry point for business units at project intake, security kickoff and tool onboarding.
• Contribute to budget, licensing and vendor conversations, and communicate technical risk clearly to senior leadership.

Essential Skills & Experience

• Bachelor’s degree in computer science, Information Security, MIS or an equivalent technical discipline.
• Significant hands‑on experience in cloud and infrastructure security engineering, at a senior or lead level.
• Demonstrable experience operating within a regulated or accredited environment — FedRAMP, GovRAMP, NIST SP 80053, ISO27001, or a comparable national scheme.
• Strong practical cloud security depth in Azure, GCP and AWS, including boundary design, network segmentation, hardening and identity.
• Experience defining and evidencing technical controls for external audit and engaging directly with assessors.
• Working fluency in application security and secure SDLC — SAST/SCA/RASP tooling, vulnerability triage, and credible engagement with development teams.
• Experience with SIEM, logging and alerting platforms and their integration into a monitored boundary.
• Ability to script and automate (Python or comparable) to reduce manual control and evidence work.
• Excellent written and verbal communication; able to explain technical risk to nontechnical and executive audiences.

Desirable Skills & Experience

• Direct experience preparing for or maintaining a FedRAMP or GovRAMP authorization.
• Familiarity with additional sovereign regimes — UK Cyber Essentials Plus / NCSC, EU GDPR and NIS2, China MLPS/PIPL, Saudi NCA ECC, Australia ASD Essential Eight.
• Experience supporting government or public‑sector customers under contractual security obligations.
• Vulnerability management and posture management tooling at enterprise scale.
• Experience with CI/CD pipelines and infrastructure as code in a regulated context.
• Professional accreditation such as CISSP, CISM, CCSP or equivalent.
• Prior experience mentoring engineers or leading a small technical function.
• Comfort operating in an agile environment with shifting priorities and multiple concurrent regulatory deadlines.

Compensation and Benefits

Compensation at Pearson is influenced by factors including skill set, experience, and location.

The full‑time salary range for this role is $80,000 – $125,000. This position is eligible to participate in an annual incentive program. Information on benefits can be found here.

Applications will be accepted through 2nd November 2026. This window may be extended depending on business needs.

Who we are

At Pearson, our purpose is simple: to help people realize the life they imagine through learning. We believe that every learning opportunity is a chance for a personal breakthrough. We are the world’s lifelong learning company. For us, learning isn't just what we do. It's who we are. To learn more: We are Pearson.

Equal Opportunity

Pearson is an Equal Opportunity Employer and a member of E‑Verify. Employment decisions are based on qualifications, merit and business need. Qualified applicants will receive consideration for employment without regard to race, ethnicity, color, religion, sex, sexual orientation, gender identity, gender expression, age, national origin, protected veteran status, disability status or any other group protected by law. We actively seek qualified candidates who are protected veterans and individuals with disabilities as defined under VEVRAA and Section 503 of the Rehabilitation Act.

If you are an individual with a disability and are unable or limited in your ability to use or access our career site as a result of your disability, you may request reasonable accommodations by emailing [e-mail].

Job Information

Job: Engineering

Job Family: TECHNOLOGY

Organization: OCTO

Schedule: FULL_TIME

Workplace Type: Hybrid

Req ID: 26452