Use Data to Drive Decisions

• Establish reliable views of BU security performance.
• Analyse security data to identify trends, root causes and priority areas.
• Challenge inaccurate, incomplete or misleading security data.
• Translate security data into actionable priorities for technology leadership.
• Measure whether interventions have actually improved the security outcome.
• Provide transparent reporting to the DRO and relevant governance forums.

Key Relationships

BU / Function DRO

The role reports to and works closely with the DRO.

The DRO remains accountable for the BU/function's risk. The Security Engineering Lead is accountable for achieving agreed security outcomes and providing the DRO with the expertise, insight and delivery focus required to improve those outcomes.

Technology Leadership and Engineering Teams

The role operates as part of the BU technology organisation and works directly with engineering, infrastructure, application, identity and other technology teams to deliver improved security outcomes.

GRC

Works with GRC to:

• understand applicable policies, standards and control requirements;
• provide evidence of security performance and remediation;
• identify and escalate material risks;
• support independent governance and assurance; and
• maintain consistency of security expectations across the organisation.

GRC provides the independent governance and challenge function; the Security Engineering Lead is focused on improving the BU's actual security outcomes.

Security Architecture

Works with Security Architecture where specialist expertise, design authority or complex security decisions are required.

Wider Security Function

Participates in the Security community, sharing knowledge, patterns, data and successful solutions while retaining primary accountability for the BU's agreed outcomes.

What You Bring

Essential

• Significant experience in technology, engineering, cyber security or a closely related discipline.
• Strong understanding of practical cyber security controls and technology risk.
• Demonstrable experience working directly with technology and engineering teams.
• Ability to understand security standards and translate them into practical technical outcomes.
• Strong analytical and data-driven problem-solving skills.
• Experience improving measurable operational or technology outcomes.
• Ability to understand complex technical environments and identify root causes of security problems.
• Strong stakeholder management and influencing skills.
• Ability to challenge constructively and escalate when required.
• Comfortable working with ambiguity and determining practical solutions rather than simply identifying problems.

Desirable

• Engineering, software development, infrastructure or architecture background.
• Experience with vulnerability/patch management, IAM/PAM, cloud security or security operations.
• Experience automating security processes or controls.
• Experience working within regulated or highly controlled environments.
• Relevant professional security qualifications or equivalent practical experience.

Behaviours

The successful candidate will:

• Think like an engineer.
• Act like part of the business.
• Own outcomes.
• Use evidence.
• Be pragmatic.
• Know when to collaborate.
• Build capability, not dependency.

Measures of Success

Success will be measured primarily through improved security outcomes, for example:

• Improvement against agreed vulnerability and patching targets
• Reduction in EOL/EOS exposure
• Improvement in privileged access review performance
• Reduction in security remediation backlog and ageing
• Reduction in recurring security findings
• Improvement in security control effectiveness
• Increased adoption of secure-by-design practices
• Increased automation of security controls and processes
• Improved quality and reliability of security data
• Timely and appropriate escalation of material security risks
• Demonstrable reduction in the BU's overall security exposure

The role is not measured primarily by the amount of security activity performed. The measure is whether the BU becomes measurably more secure.

What Makes This Role Different

This role is intentionally designed as an embedded security engineering capability rather than a traditional advisory BISO role.

The individual is part of the BU, understands its technology environment, works directly with its engineers and leaders, and is accountable for improving agreed security outcomes.

Unlike traditional advisory security roles, the Security Engineering Lead is expected to influence, coordinate and drive remediation activity through the BU technology organisation until agreed outcomes are achieved.

The role therefore sits at the intersection of:

Security expertise + Technology engineering + Data + Business accountability

Its success is demonstrated by what changes in the BU — not simply by what the Security function reports about it.

Why Pearson?

This role represents a significant shift in how security is delivered across Pearson. Rather than operating as a central advisory function, the Security Engineering Lead is embedded within the business and accountable for driving measurable improvements in security outcomes where risk is created and managed.

The role provides the opportunity to work directly with technology leaders, engineers and business stakeholders to solve real security problems, improve resilience and reduce risk at scale.

Success is measured through better security outcomes, stronger technology practices and a demonstrably more secure business.

As Pearson continues to strengthen its security capabilities, this role offers the opportunity to influence technology decisions, improve security performance across critical services, and help establish a model in which security is treated as an integral part of good technology engineering rather than a separate compliance activity.