Well I don't think it's really a role in an organisation, so much as a user of that organisation's product from what I can see. The author appears to be teachin

Well I don't think it's really a role in an organisation, so much as a user of that organisation's product from what I can see. The author appears to be teaching some course on Coursera later this year, not working directly for Coursera. It's probably more like a Facebook user finding a security exploit, disclosing (responsibly or not as has been discussed in this thread), then posting a blog on their findings, rather than one of Facebook's team posting a blog talking about how bad Facebook's security is.