Senior Application Security Engineer - Cloud & FedRAMP

Pearson Candidate Experience; Durham (NC); On-site; USD 100,000 - 160,000; Full time

Job summary

Pearson Candidate Experience seeks an experienced Application Security Engineer to own security across the software development lifecycle for our sovereign estate. You will embed security into product, engineering, DevOps and release processes, conduct threat modeling, and enforce secure design in the pipeline with validated remediation.

This technical role includes leadership in tooling, budget discussions, and vendor engagements, with senior-level conversations on security direction and

Qualifications

• Senior or lead level AppSec experience in an enterprise environment.
• Ability to translate sovereign requirements into concrete controls.
• Experience integrating security into CI/CD pipelines.

Responsibilities

• Own secure SDLC ownership across concept to production monitoring.
• Lead threat modeling, design reviews and secure architecture decisions.
• Define risk-based security gates and remediation timelines.
• Operate and mature AppSec tooling across pipelines and repos.
• Engage with 3PAOs and government customers on AppSec questions.
• Coach engineers on secure coding and provide actionable feedback.

Skills

AppSec leadership

Threat modeling

CI/CD security

Secure design review

OWASP Top 10

Cloud security (Azure/AWS)

Python scripting

External audit / pen tests

Effective communication

Education

Bachelor's degree in Computer Science or Information Security

Tools

SAST

SCA

Secrets scanning

IaC scanning

Container scanning

RASP

Job description

Pearson Candidate Experience seeks an experienced Application Security Engineer to own security across the software development lifecycle for our sovereign estate. You will embed security into product, engineering, DevOps and release processes, conduct threat modeling, and enforce secure design in the pipeline with validated remediation.

This technical role includes leadership in tooling, budget discussions, and vendor engagements, with senior-level conversations on security direction and