Staff Data Engineer

Job Title: Staff Data Engineer

About the role

Pearson Virtual Schools runs online K-12 programs, including Connections Academy and Pearson Online Academy, for students and families across the country. Our data includes some of the most sensitive information there is: student assessment results and records protected under FERPA. As AI tools start working with that data next to our people, the access rules have to be right for both.

We're starting a new Data Engineering group, and this is one of its first two hires. You'll design and build how our data is secured and served to AI from the start. That means fine-grained access enforced in the data itself, plus a governed gateway, built on the Model Context Protocol (MCP), through which AI agents act as the user: same models, same permissions, one security model for people and AI.

This is a greenfield, senior technical role. You'll be the go-to expert on data security and AI access, make the key architecture decisions, and mentor the engineers around you.

What you'll do

• Enforce access in the data. Implement per-user and per-location access in BigQuery using row-access policies and column-level masking, so each person sees only the data they're entitled to.
• Make purpose part of the policy. Design and build purpose-based access control (raw, anonymized, or aggregated data depending on the declared purpose), with policies authored in Collibra and enforced natively in BigQuery.
• Open a governed door for AI. Build an MCP service over our LookML semantic layer. AI agents authenticate as the user and inherit that user's access, with no separate back door.
• Keep costs bounded. Put guardrails on AI and ad-hoc query spend using custom quotas, maximum-bytes-billed limits, slot reservations, and caching.
• Design end to end. Work closely with our Senior Analytics Engineer (Semantic Layer) so security and the semantic layer fit together cleanly.
• Make it auditable. Document security patterns and access procedures so the platform is easy to operate, review, and extend.

What you'll bring

• Hands-on experience with fine-grained security on a cloud data warehouse: row-level and column-level security, masking, authorized views, and IAM. BigQuery is ideal, and Snowflake or Databricks experience also counts.
• A solid grounding in data security and governance: role- and attribute-based access control, PII handling, and anonymization / masking.
• Platform and integration engineering skills: you can build and run a service that handles authentication and passes user identity through to the data (OAuth or similar).
• Strong SQL, plus enough familiarity with a semantic / BI layer (LookML or similar) to expose it safely.
• Python or a comparable language for service development.
• Comfort working on your own in a greenfield setting and setting patterns others follow.
• Usually 8+ years in data engineering, data platform, or data security engineering, including leading at least one critical technical initiative.

Nice to have

• MCP or other LLM tool-use / agent integrations; Looker API or embedding.
• BigQuery cost governance.
• Collibra policy automation.
• Federated query engines (Trino / Starburst).
• Experience with FERPA, HIPAA, or other regulated data.

Don't tick every box? Apply anyway. If you've secured sensitive data at scale and want to work out how AI should access it safely, we'd like to hear from you.

Why you'll love it

• A rare greenfield problem. Secure, identity-aware AI access to governed data is still new ground, and you'll help define it.
• Work that protects students. You'll safeguard data that belongs to kids and families.
• Senior scope without managing people. You'll own the architecture as an individual contributor.
• Shape a new team. As an early hire, your patterns become the group's patterns.