Job Title: Staff Data Engineer
About the role
Pearson Virtual Schools runs online K-12 programs, including Connections Academy and Pearson Online Academy, for students and families across the country. Our data includes some of the most sensitive information there is: student assessment results and records protected under FERPA. As AI tools start working with that data next to our people, the access rules have to be right for both.
We're starting a new Data Engineering group, and this is one of its first two hires. You'll design and build how our data is secured and served to AI from the start. That means fine-grained access enforced in the data itself, plus a governed gateway, built on the Model Context Protocol (MCP), through which AI agents act as the user: same models, same permissions, one security model for people and AI.
This is a greenfield, senior technical role. You'll be the go-to expert on data security and AI access, make the key architecture decisions, and mentor the engineers around you.
What you'll do
- Enforce access in the data. Implement per-user and per-location access in BigQuery using row-access policies and column-level masking, so each person sees only the data they're entitled to.
- Make purpose part of the policy. Design and build purpose-based access control (raw, anonymized, or aggregated data depending on the declared purpose), with policies authored in Collibra and enforced natively in BigQuery.
- Open a governed door for AI. Build an MCP service over our LookML semantic layer. AI agents authenticate as the user and inherit that user's access, with no separate back door.
- Keep costs bounded. Put guardrails on AI and ad-hoc query spend using custom quotas, maximum-bytes-billed limits, slot reservations, and caching.
- Design end to end. Work closely with our Senior Analytics Engineer (Semantic Layer) so security and the semantic layer fit together cleanly.
- Make it auditable. Document security patterns and access procedures so the platform is easy to operate, review, and extend.
What you'll bring
- Hands-on experience with fine-grained security on a cloud data warehouse: row-level and column-level security, masking, authorized views, and IAM. BigQuery is ideal, and Snowflake or Databricks experience also counts.
- A solid grounding in data security and governance: role- and attribute-based access control, PII handling, and anonymization / masking.
- Platform and integration engineering skills: you can build and run a service that handles authentication and passes user identity through to the data (OAuth or similar).
- Strong SQL, plus enough familiarity with a semantic / BI layer (LookML or similar) to expose it safely.
- Python or a comparable language for service development.
- Comfort working on your own in a greenfield setting and setting patterns others follow.
- Usually 8+ years in data engineering, data platform, or data security engineering, including leading at least one critical technical initiative.
Nice to have
- MCP or other LLM tool-use / agent integrations; Looker API or embedding.
- BigQuery cost governance.
- Collibra policy automation.
- Federated query engines (Trino / Starburst).
- Experience with FERPA, HIPAA, or other regulated data.
Don't tick every box? Apply anyway. If you've secured sensitive data at scale and want to work out how AI should access it safely, we'd like to hear from you.
Why you'll love it
- A rare greenfield problem. Secure, identity-aware AI access to governed data is still new ground, and you'll help define it.
- Work that protects students. You'll safeguard data that belongs to kids and families.
- Senior scope without managing people. You'll own the architecture as an individual contributor.
- Shape a new team. As an early hire, your patterns become the group's patterns.
#LI-Hybrid
Skills Required
- Hands-on experience with fine-grained security in a cloud data warehouse, including row-level and column-level security, masking, authorized views, and IAM
- Experience with BigQuery, Snowflake, or Databricks
- Strong grounding in data security and governance, including role-based access control, attribute-based access control, PII handling, and anonymization or masking
- Platform and integration engineering experience building and operating services that authenticate users and pass identity through to data systems
- Experience with OAuth or a comparable authentication technology
- Strong SQL skills
- Familiarity with LookML or a similar semantic or BI layer
- Python or a comparable programming language for service development
- Ability to work independently in a greenfield environment and establish technical patterns
- Usually 8 or more years of experience in data engineering, data platform, or data security engineering
- Experience leading at least one critical technical initiative
- Experience with MCP or other LLM tool-use or agent integrations
- Looker API or embedding experience
- BigQuery cost governance experience
- Collibra policy automation experience
- Experience with federated query engines such as Trino or Starburst
- Experience handling FERPA, HIPAA, or other regulated data
What We Do
We are the world’s learning company with more than 22,500 employees operating in 70 countries. We provide content, assessment and digital services to learners, educational institutions, employers, governments and other partners globally. We are committed to helping equip learners with the skills they need to enhance their employability prospects and to succeed in the changing world of work. We believe that wherever learning flourishes so do people.
