Information System Security Officer (Government)
About The Position
AT&T Global Public Sector is seeking an Information System Security Officer (ISSO) for its Integrity, Compliance & Risk Management Team. The team supports secure, resilient, authorization-ready services for the Public Sector market. This role provides technical leadership translating FISMA, NIST Risk Management Framework requirements, agency policy, and contractual obligations into security practices that protect AT&T, build customer confidence, and reduce business and operational risk. The ISSO works across product, engineering, operations, executive leadership, and government stakeholders to guide services through the cybersecurity compliance lifecycle, from architecture and control design through assessment, Authorization to Operate (ATO), continuous monitoring, and ongoing authorization. The position combines strategic influence with hands-on technical expertise. The ISSO will lead RMF activities and authorization-package development, oversee control assessments and remediation governance, establish continuous-compliance practices, review security architectures and system changes, and communicate security posture and residual risk. The role is full-time and onsite five days per week at the designated work location in Chantilly, Virginia. No relocation is offered.
Requirements
- Bachelor’s degree.
- Active CISSP certification.
- Required Public Trust clearance.
- Expertise in identity and access management.
Nice To Haves
- CSM certification.
- Security+ (Sec+) certification.
- Advanced proficiency with Xacta 360 or comparable governance, risk, and compliance platforms.
- Hands-on experience with Tenable Security Center and enterprise vulnerability management practices.
- Working knowledge of the ServiceNow ecosystem, including GRC and vulnerability management.
- Experience with the FedRAMP and CMMC certification processes and deployment of certified cloud service offers.
Responsibilities
- Lead NIST RMF lifecycle activities, including system categorization, control selection and tailoring, implementation, assessment, authorization, continuous monitoring, and ongoing authorization using Xacta.
- Translate FISMA, FedRAMP, DoD RMF, CMMC, agency policy, and contractual requirements into security control implementation plans, technical standards, security requirements, and operating procedures.
- Develop and quality-assure authorization packages in Xacta, including system security plans, security assessment reports, control implementation statements, privacy artifacts, contingency plans, risk assessments, and supporting evidence.
- Plan and oversee security control assessments, validate control operation, identify implementation deficiencies, analyze root causes, and verify corrective actions and evidence in Xacta.
- Lead POA&M governance using Xacta and ServiceNow, ensuring vulnerabilities and control deficiencies are prioritized, assigned, tracked, and remediated within risk-based timelines.
- Establish continuous-compliance and monitoring practices using automated control evidence, security configuration baselines, endpoint telemetry, SIEM capabilities, and Tenable Security Center vulnerability data.
- Analyze and govern vulnerabilities identified through Tenable Security Center, validate findings, assess risk and asset criticality, coordinate remediation through ServiceNow, and maintain traceability to applicable controls and POA&Ms in Xacta.
- Perform security architecture and design reviews across identity, network, application, data, cloud, and operational security domains; identify control gaps and recommend risk-reduction measures.
- Assess the security impact of system changes, including technologies, cloud services, APIs, data exchanges, integrations, boundary modifications, and changes to architecture, operations, or data flows.
- Apply Zero Trust and threat-informed risk principles, including strong identity, least privilege, device assurance, segmentation, continuous verification, policy-based access, and compensating controls.
- Integrate security governance into ServiceNow configuration, change, release, incident, and problem-management workflows, including security reviews for infrastructure-as-code and automated deployment pipelines.
- Communicate security posture and residual risk to system owners, authorizing officials, governance bodies, and executive stakeholders using risk indicators, compliance trends, vulnerability metrics, POA&M status, mitigation options, and decision-ready information from Xacta, Tenable Security Center, and ServiceNow.
Benefits
- Medical, dental, and vision coverage.
- 401(k) plan.
- Tuition reimbursement program.
- Paid time off and holidays, including at least 23 vacation days each year and 9 company-designated holidays, based on date of hire.
- Paid parental leave.
- Paid caregiver leave.
- Additional sick leave may be available beyond what state and local law require.
- Adoption reimbursement.
- Short- and long-term disability benefits.
- Life and accidental death insurance.
- Supplemental benefit programs, including critical illness, accident hospital indemnity, and group legal coverage.
- Employee Assistance Programs (EAP).
- Employee wellness programs.
- Employee discounts of up to 50% on eligible AT&T mobility plans and accessories, AT&T internet and fiber where available, and AT&T phone.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
