Advanced Specialist, Application Security

Summary

The Sovereign Team is the technical cybersecurity team of Pearson’s cybersecurity organization that works with the Lines of Business on contractual and regulatory obligations as it relates to sovereign requirements from countries around the world. We are not a compliance or audit function; we are the deep technical experts on cloud, infrastructure and application security who hold the architectural knowledge that makes certifications such as FedRAMP, GovRAMP and Cyber Essentials Plus achievable and defensible.

As Application Security Enginee r, you will own application security across the software development lifecycle for Pearson’s regulated and sovereign estate. You will embed security into existing product, engineering, Dev Ops and release processes; threat modeling and architecture review at design, scanning and policy enforcement in the pipeline, and validated remediation before and after release; so that findings reduce real risk rather than accumulate in a queue.

This is a technical role with leadership responsibility. You will set App Sec technical direction, mentor engineers, and act as the escalation point for complex application security problems. It is not a people-management role, but you will be expected to carry senior-level conversations, including tooling, budget and vendor discussions.

Key Responsibilities

Secure SDLC ownership

• Own and continuously improve a repeatable Application Security process spanning concept and intake, requirements and design, development, build and CI/CD, test and preproduction, release, and production monitoring.

• Work with Enterprise Application Security to define which App Sec activities and tools apply at each phase, what evidence each phase must produce, who owns the work, and how findings are handled before and after release.

• Lead threat modeling, use case review and secure design review; authentication and authorization design, privacy, and logging requirements.

• Set risk based security gates: critical and high risk issues reviewed before release, lower risk items tracked to agreed remediation timelines.

• Ensure every finding has an owner and an SLA, and is triaged, remediated, accepted or closed as not applicable; never left open by default.

App Sec tooling & automation

• Own selection, design, onboarding and optimization of the App Sec toolchain; SAST, SCA, secrets scanning, IaC scanning, container scanning, DAST and IAST/RASP.

• Operate and mature the current stack across the development pipelines/code repositories.

• Drive repository and space onboarding to close coverage gaps, and run the discovery loop that finds unscanned origins as the estate changes.

• Enforce pipeline policy and artifact integrity; CI/CD gates, SBOM generation, image scanning and artifact signing.

• Automate triage, ticket routing and evidence collection to reduce manual effort and improve consistency.

• Assist with tuning of preventative technologies such as RASP and WAF.

Sovereign & regulated assurance

• Translate FedRAMP 20x, GovRAMP Rev5, NCSC Cyber Assessment Framework, UK Cyber Essentials Plus and equivalent requirements into concrete application security controls and defensible evidence.

• Validate that application architecture is deployed correctly against each sovereign requirement; not merely documented as compliant.

• Provide application penetration test scoping and assurance, and manage remediation followup through to closure.

• Lead technical audit preparation and evidence quality review; support POA&M and continuous monitoring cycles.

• Engage directly with 3
  
  PAOs, external assessors and government customers on application control questions.

Engagement & technical leadership

• Act as an application security entry point at project intake and cyber security kickoff; confirming application…