Advanced Specialist, Application Security

Pearson•Durham, NC

2h•$100,000 - $160,000

About The Position

The Sovereign Team is part of Pearson’s cybersecurity organization and works with Lines of Business on contractual and regulatory obligations related to sovereign requirements. The team provides technical expertise in cloud, infrastructure, and application security to support certifications such as FedRAMP, GovRAMP, and Cyber Essentials Plus. The Application Security Engineer owns application security across the software development lifecycle for Pearson’s regulated and sovereign estate. The role embeds security into product, engineering, DevOps, and release processes through threat modeling and architecture reviews, pipeline scanning and policy enforcement, and validated remediation before and after release. This is a technical leadership position that sets AppSec direction, mentors engineers, and serves as an escalation point for complex application security issues. It is not a people-management role, but includes senior-level tooling, budget, and vendor discussions.

Requirements

Bachelor’s degree in computer science, Information Security, MIS, or an equivalent technical discipline.
Significant hands-on application security experience at a senior or lead level in an enterprise environment.
Deep practical experience with SAST, SCA, secrets scanning, and container/IaC scanning, including tuning, false-positive management, and developer-facing triage.
Proven experience integrating security into CI/CD pipelines and defining risk-based release gates.
Strong threat modeling and secure design review capability, such as STRIDE, including authentication and authorization architecture.
Working knowledge of OWASP Top 10 and secure coding practices across modern web and API stacks.
Cloud security depth in Azure and/or AWS as it applies to application workloads and boundaries.
Ability to script and automate using Python or a comparable language to reduce manual triage and evidence work.
Experience defining and evidencing technical controls for external audit or penetration testing.
Excellent written and verbal communication skills, with credibility among developers and executive audiences.

Nice To Haves

Direct experience supporting a FedRAMP or GovRAMP authorization from the application side.
Familiarity with additional sovereign regimes, including UK Cyber Essentials Plus/NCSC Secure Design Principles, EU GDPR and NIS2, China MLPS/PIPL, Saudi NCA ECC, and Australia ASD Essential Eight.
Experience with vulnerability aggregation and posture-management platforms such as ArmorCode, Wiz, or equivalents.
Software development background and ability to review code credibly, not just scan output.
Experience running a developer security enablement or training program.
Prior experience mentoring engineers or leading a small technical function.
Comfort operating in an agile environment with multiple concurrent regulatory deadlines.
Professional accreditation such as CISSP, CSSLP, CCSP, or equivalent.

Responsibilities

Own and continuously improve a repeatable Application Security process spanning concept and intake, requirements and design, development, build and CI/CD, test and preproduction, release, and production monitoring.
Work with Enterprise Application Security to define AppSec activities and tools at each phase, required evidence, ownership, and finding-handling processes.
Lead threat modeling, use case review, and secure design review, including authentication and authorization design, privacy, and logging requirements.
Set risk-based security gates, reviewing critical and high-risk issues before release and tracking lower-risk items to agreed remediation timelines.
Ensure each finding has an owner and SLA and is triaged, remediated, accepted, or closed as not applicable.
Own selection, design, onboarding, and optimization of the AppSec toolchain, including SAST, SCA, secrets scanning, IaC scanning, container scanning, DAST, and IAST/RASP.
Operate and mature the current AppSec stack across development pipelines and code repositories.
Drive repository and space onboarding to close coverage gaps and discover unscanned origins as the estate changes.
Enforce pipeline policy and artifact integrity, including CI/CD gates, SBOM generation, image scanning, and artifact signing.
Automate triage, ticket routing, and evidence collection to reduce manual effort and improve consistency.
Assist with tuning preventative technologies such as RASP and WAF.
Translate FedRAMP 20x, GovRAMP Rev5, NCSC Cyber Assessment Framework, UK Cyber Essentials Plus, and equivalent requirements into application security controls and defensible evidence.
Validate application architecture deployment against sovereign requirements, not merely its documentation.
Provide application penetration test scoping and assurance, and manage remediation follow-up through closure.
Lead technical audit preparation and evidence quality review; support POA&M and continuous monitoring cycles.
Engage with 3PAOs, external assessors, and government customers on application control questions.
Act as an application security entry point at project intake and cybersecurity kickoff, confirming application tier, scan-tool onboarding, baseline compliance, and go-live requirements.
Provide oversight, direction, and advice to engineers by reviewing security designs and implementations.
Coach developers on secure coding and provide actionable feedback while design and code decisions are current.
Build reusable standards, playbooks, and onboarding material to scale AppSec capability.
Communicate application risk to engineering teams, business partners, and senior leadership.