Advanced Specialist, Application Security

Pearson•Durham, NC

About The Position

The Sovereign Team is the technical cybersecurity team within Pearson’s cybersecurity organization. It works with Lines of Business on contractual and regulatory obligations related to sovereign requirements worldwide. The team provides deep technical expertise in cloud, infrastructure, and application security to support defensible certifications such as FedRAMP, GovRAMP, and Cyber Essentials Plus; it is not a compliance or audit function. The Advanced Specialist, Application Security owns application security across the software development lifecycle for Pearson’s regulated and sovereign estate. The role embeds security into product, engineering, DevOps, and release processes through threat modeling and architecture review, pipeline scanning and policy enforcement, and validated remediation before and after release. It sets Application Security technical direction, mentors engineers, and serves as an escalation point for complex application security issues. This is a technical leadership role, not a people-management position, and includes senior-level discussions about tooling, budgets, and vendors.

Requirements

Bachelor’s degree in computer science, Information Security, MIS, or an equivalent technical discipline.
Significant hands-on application security experience at a senior or lead level in an enterprise environment.
Deep practical experience with SAST, SCA, secrets scanning, and container/IaC scanning, including tuning, false-positive management, and developer-facing triage.
Proven experience integrating security into CI/CD pipelines and defining risk-based release gates.
Strong threat-modeling and secure-design-review capability, such as STRIDE, including authentication and authorization architecture.
Working knowledge of the OWASP Top 10 and secure coding practices across modern web and API stacks.
Cloud security depth in Azure and/or AWS as it applies to application workloads and boundaries.
Ability to script and automate using Python or a comparable language to reduce manual triage and evidence work.
Experience defining and evidencing technical controls for external audit or penetration testing.
Excellent written and verbal communication skills, with credibility among developers and executive audiences.

Nice To Haves

Direct experience supporting a FedRAMP or GovRAMP authorization from the application side.
Familiarity with additional sovereign regimes, including UK Cyber Essentials Plus/NCSC Secure Design Principles, EU GDPR and NIS2, China MLPS/PIPL, Saudi NCA ECC, and Australia ASD Essential Eight.
Experience with vulnerability aggregation and posture-management platforms such as ArmorCode, Wiz, or equivalents.
Software development background and ability to review code credibly, not just scan output.
Experience running a developer security enablement or training program.
Prior experience mentoring engineers or leading a small technical function.
Comfort operating in an agile environment with multiple concurrent regulatory deadlines.
Professional accreditation such as CISSP, CSSLP, CCSP, or equivalent.

Responsibilities

Own and continuously improve a repeatable Application Security process spanning intake, requirements and design, development, build and CI/CD, testing and preproduction, release, and production monitoring.
Work with Enterprise Application Security to define AppSec activities and tools for each lifecycle phase, required evidence, ownership, and finding-handling processes.
Lead threat modeling, use-case reviews, and secure design reviews, including authentication, authorization, privacy, and logging requirements.
Set risk-based security gates, review critical and high-risk issues before release, and track lower-risk items against agreed remediation timelines.
Ensure each finding has an owner and SLA and is triaged, remediated, accepted, or closed as not applicable.
Own selection, design, onboarding, and optimization of the AppSec toolchain, including SAST, SCA, secrets scanning, IaC scanning, container scanning, DAST, and IAST/RASP.
Operate and mature the current AppSec stack across development pipelines and code repositories; onboard repositories and spaces, address coverage gaps, and discover unscanned origins as the estate changes.
Enforce pipeline policy and artifact integrity, including CI/CD gates, SBOM generation, image scanning, and artifact signing.
Automate triage, ticket routing, and evidence collection to reduce manual effort and improve consistency.
Assist with tuning preventative technologies such as RASP and WAF.
Translate FedRAMP 20x, GovRAMP Rev5, the NCSC Cyber Assessment Framework, UK Cyber Essentials Plus, and equivalent requirements into concrete application security controls and defensible evidence.
Validate that application architecture is deployed correctly against sovereign requirements, not merely documented as compliant.
Scope application penetration tests, provide assurance, and manage remediation follow-up through closure.
Lead technical audit preparation and evidence-quality review, and support POA&M and continuous monitoring cycles.
Engage directly with 3PAOs, external assessors, and government customers on application control questions.
Serve as an application security entry point at project intake and cybersecurity kickoff, confirming application tier, scanning-tool onboarding, baseline compliance, and go-live requirements.
Provide oversight, direction, and advice to engineers by reviewing security designs and implementations.
Coach developers on secure coding and provide actionable feedback while design and code decisions are still fresh.
Build reusable standards, playbooks, and onboarding materials so AppSec capability can scale beyond individuals.
Communicate application risk clearly to engineering teams, business partners, and senior leadership.
Participate in senior-level discussions, including tooling, budget, and vendor discussions.
Mentor engineers and act as the escalation point for complex application security problems.