Advanced Specialist, Security Engineer

Pearson•Durham, NC

2h•$80,000 - $125,000•Remote

About The Position

The Sovereign Team is the technical cybersecurity team within Pearson’s cybersecurity organization, partnering with Lines of Business on contractual and regulatory requirements related to sovereign environments. The team provides technical expertise in cloud, infrastructure, and application security to support certifications such as FedRAMP, GovRAMP, and Cyber Essentials Plus. The Security Engineer is a senior hands-on technical individual contributor who leads independent efforts, validates that architectures are implemented in alignment with sovereign requirements, designs and operates security tooling for regulated boundaries, and provides technical oversight and mentorship to engineers. The role represents the team with business units, enterprise security teams, external auditors, and government customers, and participates in senior-level budget and vendor discussions. It carries technical leadership responsibilities but is not a people-management role.

Requirements

Bachelor’s degree in computer science, Information Security, MIS, or an equivalent technical discipline.
Significant hands-on experience in cloud and infrastructure security engineering at a senior or lead level.
Demonstrable experience working in a regulated or accredited environment, such as FedRAMP, GovRAMP, NIST SP 800-53, ISO 27001, or a comparable national scheme.
Practical cloud security expertise in Azure, GCP, and AWS, including boundary design, network segmentation, hardening, and identity.
Experience defining and evidencing technical controls for external audits and engaging directly with assessors.
Working fluency in application security and secure SDLC, including SAST/SCA/RASP tooling, vulnerability triage, and engagement with development teams.
Experience with SIEM, logging, and alerting platforms and their integration into a monitored boundary.
Ability to script and automate using Python or a comparable language to reduce manual control and evidence work.
Excellent written and verbal communication skills, including the ability to explain technical risk to nontechnical and executive audiences.

Nice To Haves

Direct experience preparing for or maintaining a FedRAMP or GovRAMP authorization.
Familiarity with additional sovereign regimes, including UK Cyber Essentials Plus/NCSC, EU GDPR and NIS2, China MLPS/PIPL, Saudi NCA ECC, and Australia ASD Essential Eight.
Experience supporting government or public-sector customers under contractual security obligations.
Experience with vulnerability management and posture management tooling at enterprise scale.
Experience with CI/CD pipelines and infrastructure as code in a regulated context.
Professional accreditation such as CISSP, CISM, CCSP, or equivalent.
Prior experience mentoring engineers or leading a small technical function.
Comfort working in an agile environment with shifting priorities and multiple concurrent regulatory deadlines.

Responsibilities

Conduct readiness assessments for business units entering regulated or sovereign environments, including reviews of authorization boundaries and data flows.
Identify architectural blockers across identity, cloud, application, logging, and data controls.
Validate whether proposed tools and services are suitable for the applicable boundary and escalate concerns when they are not.
Translate regulatory and contractual requirements into technical designs, standards, and hardening guidance.
Lead selection, design, and onboarding of paved-road tools for regulated environments.
Define sovereign requirements for enterprise-operated tooling, validate suitability, and coordinate with enterprise platform owners.
Design and support boundary-critical capabilities such as identity, WAF, DSPM, and logging/SIEM architecture.
Identify and automate opportunities to reduce manual control validation and evidence gathering.
Create scripts to support FedRAMP 20x automation of governance and compliance measurements for Rules and KSIs.
Oversee vulnerability and control health across the sovereign estate, escalating risk trends and missed remediation commitments to the appropriate owners.
Provide penetration-test scope assurance and cadence support, including annual IT Health Check and ATO cycles.
Lead technical audit preparation and evidence-quality review; support POA&M, KEV, and STIG activity.
Interface directly with 3PAOs, external assessors, and government customers on technical control questions.
Review security designs and implementations, and provide oversight, direction, and advice to cybersecurity engineers.
Mentor and develop engineers in sovereign requirements, secure architecture, and secure SDLC practices.
Build reusable playbooks, standards, and onboarding material to scale team capability.
Serve as a technical entry point for business units at project intake, security kickoff, and tool onboarding.
Contribute to budget, licensing, and vendor discussions, and communicate technical risk to senior leadership.