Advanced Specialist, Security Engineer

Job Title: Advanced Specialist, Security EngineerAbout the Role: The BU Security Engineering Lead is a security-skilled technology professional whoreports to the BU/function's Designated Risk Owner (DRO), with a dotted-linealignment to central Security to maintain consistency with enterprise security strategy,standards and priorities.

The role is accountable for improving the BU/function'ssecurity outcomes and achieving agreed security objectives and metrics, workingclosely with GRC, Security Architecture and other central Security capabilities. The role combines security expertise, technical leadership, engineering thinking, data-driven problem solving and strong business understanding.

The Security EngineeringLead is part of the BU technology organisation, identifying security weaknesses,understanding their root causes and delivering practical solutions that measurablyreduce security risk. The role is accountable for improving the BU/function's security outcomes andachieving agreed security objectives and metrics. What You'll DoOwn improvement in BU security outcomes

Take accountability for achieving agreed security objectives, targets and metricsfor the BU/function.
Establish a clear understanding of the BU's current security performance, keyexposures and areas of greatest risk.
Use security data, trends and analysis to identify priorities and opportunities forimprovement.
Develop and execute plans to improve security performance and reducemeasurable risk. DCL2 - Internal Use Only
Track progress against agreed objectives and intervene where performance isnot improving.
Identify systemic issues and drive sustainable improvements rather thanrepeatedly addressing individual findings. Drive remediation of security riskWork directly with technology teams to improve performance against key securityoutcomes, including areas such as:
Vulnerability and patch management
End-of-life/end-of-support technology
Privileged access management and reviews
Security control implementation
Security configuration and hardening
Security remediation backlogs
Recurring security findings
Other BU-specific security prioritiesThe role is expected to understand why a metric is poor and determine what needs tochange to improve it. This may include process changes, technology changes, automation, dataimprovements, changes to ownership or escalation to senior leadership. Apply engineering thinking to security problems
Use engineering principles to solve security problems at scale.
Identify opportunities to automate repetitive security activities and controls.
Use available security and technology data to identify patterns, root causes andopportunities for intervention.
Work with engineering and technology teams to design practical solutions.
Challenge approaches that rely primarily on manual activity, repeated chasing ortemporary remediation.
Help establish measurable, sustainable controls rather than one-off complianceexercises. Embed security into technology delivery
Act as the BU's security subject matter expert within technology teams.
Participate in relevant technology planning, architecture and delivery activity.
Identify security requirements early in the technology lifecycle. DCL2 - Internal Use Only
Help teams interpret and apply Security policies, standards and controlrequirements.
Identify when specialist Security Architecture or other central expertise isrequired and bring it into the work at the appropriate point.
Promote secure-by-design engineering practices. Use data to drive decisions
Establish reliable views of BU security performance.
Analyse security data to identify trends, root causes and priority areas.
Challenge inaccurate, incomplete or misleading security data.
Translate security data into actionable priorities for technology leadership.
Measure whether interventions have actually improved the security outcome.
Provide transparent reporting to the DRO and relevant governance forums. The role should be evidence-led rather than activity-led: success is demonstratedthrough improved security outcomes, not the volume of meetings, communications orassessments completed. Risk management and escalation
Provide the DRO with a clear view of current security exposure and materialchanges in risk.
Identify risks requiring escalation, remediation investment or formal riskacceptance.
Support the DRO in understanding the potential business and technology impactof security risks.
Ensure material security issues are escalated promptly and accurately.
Work with GRC to ensure risks, controls and remediation activity areappropriately recorded and evidenced. The Security Engineering Lead does not replace the DRO's accountability for risk; theyprovide the expertise, insight and delivery focus required to improve the risk position. Build security capability within the BU
Develop security awareness and capability within technology teams.
Coach engineers and technology leaders on practical application of securityrequirements.
Encourage technology teams to take increasing ownership of security withintheir services.
Share successful engineering approaches and lessons learned across the widerSecurity community. DCL2 - Internal Use Only
Contribute to a culture in which security is treated as part of good technologyengineering rather than a separate compliance activity. Key RelationshipsBU / Function DROThe role reports to and works closely with the DRO.The DRO remains accountable for the BU/function's risk. The Security Engineering Leadis accountable for achieving agreed security outcomes and providing the DRO with theexpertise, insight and delivery focus required to improve those outcomes. Technology Leadership and Engineering TeamsThe role operates as part of the BU technology organisation and works directly withengineering, infrastructure, application, identity and other technology teams to deliverimproved security outcomes. GRCWorks with GRC to:
understand applicable policies, standards and control requirements;
provide evidence of security performance and remediation;
identify and escalate material risks;
support independent governance and assurance; and
maintain consistency of security expectations across the organisation. GRC provides the independent governance and challenge function; the SecurityEngineering Lead is focused on improving the BU's actual security outcomes. Security ArchitectureWorks with Security Architecture where specialist expertise, design authority orcomplex security decisions are required. DCL2 - Internal Use OnlyWider Security FunctionParticipates in the Security community, sharing knowledge, patterns, data andsuccessful solutions while retaining primary accountability for the BU's agreedoutcomes. What You BringEssential
Significant experience in technology, engineering, cyber security or a closelyrelated discipline.
Strong understanding of practical cyber security controls and technology risk.
Demonstrable experience working directly with technology and engineeringteams.
Ability to understand security standards and translate them into practicaltechnical outcomes.
Strong analytical and data-driven problem-solving skills.
Experience improving measurable operational or technology outcomes.
Ability to understand complex technical environments and identify root causesof security problems.
Strong stakeholder management and influencing skills.
Ability to challenge constructively and escalate when required.
Comfortable working with ambiguity and determining practical solutions ratherthan simply identifying problems.

Desirable

Engineering, software development, infrastructure or architecture background.
Experience with vulnerability/patch management, IAM/PAM, cloud security orsecurity operations.
Experience automating security processes or controls.
Experience working within regulated or highly controlled environments.
Relevant professional security qualifications or equivalent practical experience. BehavioursThe successful candidate will: DCL2 - Internal Use OnlyThink like an engineer. They look for root causes, scalable solutions and ways to make security better throughtechnology and process. Act like part of the business. They understand commercial and operational priorities and find ways to improvesecurity without treating the BU as an external customer. Own outcomes. They don't stop at identifying a problem. They stay focused on getting the outcomechanged. Use evidence. They rely on accurate data and are prepared to challenge assumptions, including whenthe data is uncomfortable. Be pragmatic. They understand that perfect security is not the objective; materially reducing risk andimproving resilience is. Know when to collaborate. They don't try to be the expert in everything. They bring in GRC, Architecture or otherspecialists when appropriate. Build capability, not dependency. They leave the technology organisation stronger and more capable of managingsecurity itself. Measures of SuccessSuccess will be measured primarily through improved security outcomes, forexample:
Improvement against agreed vulnerability and patching targets
Reduction in EOL/EOS exposure
Improvement in privileged access review performance
Reduction in security remediation backlog and ageing
Reduction in recurring security findings
Improvement in security control effectiveness
Increased adoption of secure-by-design practices
Increased automation of security controls and processesDCL2 - Internal Use Only
Improved quality and reliability of security data
Timely and appropriate escalation of material security risks
Demonstrable reduction in the BU's overall security exposureThe role is not measured primarily by the amount of security activity performed. Themeasure is whether the BU becomes measurably more secure. What Makes This Role DifferentThis role is intentionally designed as an embedded security engineering capabilityrather than a traditional advisory BISO role. The individual is part of the BU, understands its technology environment, works directlywith its engineers and leaders, and is accountable for improving agreed securityoutcomes. Unlike traditional advisory security roles, the Security Engineering Lead is expected toinfluence, coordinate and drive remediation activity through the BU technologyorganisation until agreed outcomes are achieved. The role therefore sits at the intersection of: Security expertise + Technology engineering + Data + Business accountabilityIts success is demonstrated by what changes in the BU — not simply by what theSecurity function reports about it. Why Pearson? This role represents a significant shift in how security is delivered across Pearson. Rather than operating as a central advisory function, the Security Engineering Lead is embeddedwithin the business and accountable for driving measurable improvements in security outcomeswhere risk is created and managed. The role provides the opportunity to work directly with technology leaders, engineers andbusiness stakeholders to solve real security problems, improve resilience and reduce risk at scale. Success is measured through better security outcomes, stronger technology practices and ademonstrably more secure business. DCL2 - Internal Use OnlyAs Pearson continues to strengthen its security capabilities, this role offers the opportunity toinfluence technology decisions, improve security performance across critical services, and helpestablish a model in which security is treated as an integral part of good technology engineeringrather than a separate compliance activity. DCL2 - Internal Use OnlyFull timePosting Date: 2026-10-06

Apply Now

Advanced Specialist, Security Engineer

Job Details