Information System Security Officer (Government)

AT&T•Chantilly, VA

3d•$143,800 - $215,800•Onsite

About The Position

AT&T Global Public Sector is seeking an Information System Security Officer (ISSO) to provide technical leadership for cybersecurity authorizations and compliance supporting the Federal Aviation Administration Enterprise Network Services (FENS) program. The role translates FISMA, NIST Risk Management Framework, agency policy, and contractual obligations into scalable security practices that protect AT&T, strengthen customer confidence, and reduce business and operational risk. The ISSO serves as a trusted interface among product, engineering, operations, executive leadership, and government stakeholders. The role guides services through the cybersecurity compliance lifecycle, from architecture and control design through assessment, Authorization to Operate (ATO), continuous monitoring, and ongoing authorization. It combines strategic influence with hands-on technical expertise to support secure service delivery and sustained compliance. This is a full-time onsite position in Chantilly, Virginia, working five days per week at the designated work location. No relocation is offered. Applicants must have an active CISSP and Public Trust clearance; AT&T will not hire applicants who require employer visa sponsorship now or in the future. The position is listed under Lead Technology Security jobs, with an annual salary range of $143,800 to $215,800. Individual starting salary may depend on geography, experience, expertise, and education or training.

Requirements

Bachelor’s degree.
Active CISSP certification.
Public Trust clearance is required.
Advanced proficiency with Xacta 360 or comparable governance, risk, and compliance platforms.
Hands-on experience with Tenable Security Center and enterprise vulnerability management practices.
Working knowledge of the ServiceNow ecosystem, including GRC and vulnerability management.
Strong expertise in identity and access management.

Nice To Haves

CSM certification.
Security+ certification.
Experience with FedRAMP and CMMC certification processes and deployment of certified cloud service offerings.

Responsibilities

Lead NIST RMF lifecycle activities, including system categorization, control selection and tailoring, implementation, assessment, authorization, continuous monitoring, and ongoing authorization, using Xacta as the authoritative GRC and authorization-management platform.
Translate FISMA, FedRAMP, DoD RMF, CMMC, agency policy, and contractual requirements into security control implementation plans, technical standards, security requirements, and operating procedures.
Develop and quality-assure Xacta authorization packages, including system security plans, security assessment reports, control implementation statements, privacy artifacts, contingency plans, risk assessments, and supporting evidence.
Plan and oversee security control assessments; validate controls; identify deficiencies and root causes; and verify corrective actions and evidence in Xacta.
Lead POA&M governance using Xacta and ServiceNow, ensuring vulnerabilities and control deficiencies are prioritized, assigned, tracked, and remediated within risk-based timelines.
Establish continuous-compliance and monitoring practices using automated control evidence, security configuration baselines, endpoint telemetry, SIEM capabilities, and vulnerability data from Tenable Security Center.
Analyze and govern Tenable Security Center vulnerabilities, validate findings, assess risk and asset criticality, coordinate remediation through ServiceNow, and maintain traceability to controls and POA&Ms in Xacta.
Perform security architecture and design reviews across identity, network, application, data, cloud, and operational security domains; identify control gaps and recommend risk-reduction measures.
Assess the security impact of system changes, including new technologies, cloud services, APIs, data exchanges, integrations, boundary modifications, and changes to architecture, operations, or data flows.
Apply Zero Trust and threat-informed risk principles, including strong identity, least privilege, device assurance, segmentation, continuous verification, policy-based access, and compensating controls.
Integrate security governance into ServiceNow configuration, change, release, incident, and problem-management workflows, including security reviews for infrastructure-as-code and automated deployment pipelines.
Communicate security posture and residual risk to system owners, authorizing officials, governance bodies, and executive stakeholders using decision-ready risk indicators, compliance trends, vulnerability metrics, POA&M status, and mitigation options.

Benefits

Medical, dental, and vision coverage.
401(k) plan.
Tuition reimbursement program.
Paid time off and holidays, including at least 23 vacation days each year and 9 company-designated holidays, based on date of hire.
Paid parental leave.
Paid caregiver leave.
Additional sick leave may be available beyond what state and local law require; this leave is unprotected.
Adoption reimbursement.
Short- and long-term disability benefits.
Life and accidental death insurance.
Supplemental benefit programs, including critical illness, accident, hospital indemnity, and group legal benefits.
Employee Assistance Programs (EAP).
Employee wellness programs.
Employee discounts of up to 50% on eligible AT&T mobility plans and accessories, AT&T internet and fiber where available, and AT&T phone.