Advanced Specialist, Application Security

Durham, NC (hybrid) role with Pearson offering an annual incentive program eligibility and a full-time salary range of $100,000–$160,000, with compensation influenced by skill set, experience, and location.

In this position, you will own application security across the software development lifecycle for Pearson’s regulated and sovereign estate. You will embed AppSec into product, engineering, DevOps, and release processes, while acting as a technical direction point and escalation path for complex application security challenges.

What you’ll do

• Own and continuously improve a repeatable Application Security process across concept and intake, requirements and design, development, build and CI/CD, test and preproduction, release, and production monitoring.
• Partner with Enterprise Application Security to define which AppSec activities and tools apply to each phase, what evidence must be produced, who owns the work, and how findings are handled before and after release.
• Lead threat modeling, use case review, and secure design reviews, including authentication and authorization design, privacy, and logging requirements.
• Set risk-based security gates by ensuring critical and high risk issues are reviewed before release, while lower risk items are tracked to agreed remediation timelines.
• Ensure every finding has a clear owner and an SLA, with triage, remediation, acceptance, or closure as not applicable so items are never left open by default.
• Own selection, design, onboarding, and optimization of the AppSec toolchain, including SAST, SCA, secrets scanning, IaC scanning, container scanning, DAST, and IAST/RASP.
• Operate and mature the AppSec stack across development pipelines and code repositories.
• Drive repository and space onboarding to close AppSec coverage gaps and run a discovery loop to identify unscanned origins as the estate changes.
• Enforce pipeline policy and artifact integrity using CI/CD gates, SBOM generation, image scanning, and artifact signing.
• Automate triage, ticket routing, and evidence collection to reduce manual effort and improve consistency.
• Assist with tuning preventative technologies such as RASP and WAF.
• Translate FedRAMP 20x, GovRAMP Rev5, NCSC Cyber Assessment Framework, UK Cyber Essentials Plus, and equivalent requirements into concrete AppSec controls and defensible evidence.
• Validate that application architecture is deployed correctly against each sovereign requirement, not only documented as compliant.
• Provide application penetration test scoping and assurance, and manage remediation follow-up through to closure.
• Lead technical audit preparation and evidence quality review, supporting POA&M and continuous monitoring cycles.
• Engage directly with 3PAOs, external assessors, and government customers on application control questions.
• Act as an application security entry point at project intake and cyber security kickoff by confirming application tier, scantool onboarding, baseline compliance, and go live requirements.
• Provide oversight and technical advice to engineers by reviewing security designs and implementations.
• Coach developers on secure coding by providing actionable feedback while design and code decisions are still fresh.
• Build reusable standards, playbooks, and onboarding materials so AppSec capability scales beyond individuals.
• Communicate application risk clearly to engineering teams, business partners, and senior leadership.

Skills and qualifications

• Bachelor’s degree in computer science, Information Security, MIS, or an equivalent technical discipline.
• Significant hands-on application security experience at a senior or lead level in an enterprise environment.
• Deep practical experience with SAST, SCA, secrets scanning, and container/IaC scanning, including tuning, false-positive management, and developer-facing triage.
• Proven experience integrating security into CI/CD pipelines and defining risk-based release gates.
• Strong threat modeling and secure design review capability (for example, STRIDE), including authentication and authorization architecture.
• Working knowledge of OWASP Top 10 and secure coding practices across modern web and API stacks.
• Cloud security depth in Azure and/or AWS as it applies to application workloads and boundaries.
• Ability to script and automate using Python or comparable languages to reduce manual triage and evidence work.
• Experience defining and evidencing technical controls for external audit or penetration test.
• Excellent written and verbal communication, credible with developers and executive audiences.

Tools and technologies you’ll work with

• SAST, SCA, secrets scanning, IaC scanning, container scanning, DAST, IAST/RASP
• CI/CD, SBOM generation, image scanning, artifact signing
• RASP, WAF
• FedRAMP 20x, GovRAMP Rev5, NCSC Cyber Assessment Framework, UK Cyber Essentials Plus
• STRIDE, OWASP Top 10, Azure, AWS, Python
• POA&M, 3PAOs
• ArmorCode, Wiz (and equivalents)
• GDPR, NIS2, EU GDPR, China MLPS/PIPL, Saudi NCA ECC, Australia ASD Essential Eight

Eligible compensation and incentives

• This position is eligible to participate in an annual incentive program.
• Full-time salary range: $100,000–$160,000.
• Compensation at Pearson is influenced by skill set, experience, and location.

Desirable experience

• Direct experience supporting a FedRAMP or GovRAMP authorization from the application side.
• Familiarity with additional sovereign regimes such as UK Cyber Essentials Plus / NCSC Secure Design Principles, EU GDPR and NIS2, China MLPS/PIPL, Saudi NCA ECC, and Australia ASD Essential Eight.
• Experience with vulnerability aggregation and posture management platforms (ArmorCode, Wiz, or equivalents).
• Software development background with the ability to review code credibly, not just scan output.
• Experience running a developer security enablement or training program.
• Experience mentoring engineers or leading a small technical function.
• Comfort operating in an agile environment with multiple concurrent regulatory deadlines.
• Professional accreditation such as CISSP, CSSLP, CCSP, or equivalent.