Information System Security Engineer (Government)

att; Chantilly (VA); On-site; USD 120,000 - 160,000; Full time

Job summary

AT&T Global Public Sector is seeking an Information Systems Security Engineer (ISSE) to lead vulnerability management and ensure compliance across government customers in a full-time, onsite role based in Chantilly, VA. You will manage Tenable Security Center, integrate with Xacta and ServiceNow, and translate FISMA/NIST requirements into concrete security controls.

You’ll collaborate with product, engineering, and government stakeholders to deliver measurable risk reduction and robust security

Qualifications

• Lead and continuously improve the enterprise vulnerability management program using Tenable Security Center.
• Own the end-to-end vulnerability management lifecycle, including asset onboarding, scanning, validation, prioritization, remediation tracking, exception management, retesting, and closure.
• Translate FISMA, NIST RMF, NIST SP 800-53, agency requirements, and contractual obligations into measurable vulnerability management processes, controls, and governance practices.
• Develop executive dashboards, operational metrics, trend analysis, and decision-ready reporting to communicate security posture, remediation progress, and residual risk.
• Leverage expertise in Windows Server, Active Directory, Nutanix, CyberArk, SailPoint, Splunk, Infoblox, Cisco SD-WAN, NetFlow, and IPsec technologies to assess exposure and recommend risk-based remediation strategies.

Responsibilities

• Lead and continuously improve the vulnerability management program using Tenable Security Center.
• Manage Tenable Security Center architecture and operations, including scan strategies, repositories, scanners, credentials, policies, schedules, asset inventories, dashboards, reporting, and platform integrations.
• Own the end-to-end vulnerability management lifecycle, including asset onboarding, scanning, validation, prioritization, remediation tracking, exception management, retesting, and closure.
• Integrate Tenable Security Center findings with Xacta 360 and ServiceNow workflows to support continuous monitoring, POA&M management, control evidence, risk tracking, remediation activities, and authorization reporting.
• Analyze vulnerability data, validate findings, identify coverage gaps and credentialing issues, distinguish false positives from actionable risk, and provide remediation guidance to technical teams.
• Translate FISMA, NIST RMF, NIST SP 800-53, agency requirements, and contractual obligations into measurable vulnerability management processes, controls, and governance practices.
• Develop executive dashboards, operational metrics, trend analysis, and decision-ready reporting to communicate security posture, remediation progress, and residual risk.
• Establish and maintain vulnerability management governance, including standard operating procedures, service-level objectives, escalation paths, evidence requirements, quality controls, and accountability mechanisms.
• Leverage expertise in Windows Server, Active Directory, Nutanix, CyberArk, SailPoint, Splunk, Infoblox, Cisco SD-WAN, NetFlow, and IPsec technologies to assess exposure and recommend risk-based remediation strategies.
• Correlate vulnerability information with security events, asset inventories, identity data, privileged-access records, network telemetry, DNS/IPAM information, ServiceNow records, and X.

Skills

Windows Server

Active Directory

Nutanix

CyberArk

SailPoint

Splunk

Infoblox

Cisco SD-WAN

NetFlow

IPsec

Vulnerability management

Tools

Tenable Security Center

Xacta 360

ServiceNow

Job description

This is a full-time onsite role based in the location(s) posted and is performed from the designated work location five days per week. No relocation is offered.

AT&T Global Public Sector is a trusted provider of secure, IP enabled, cloud-based, network solutions and professional services to the Federal Government. We are dedicated to recruiting, developing and empowering a diverse, high-performing workforce that is passionate about what they do, committed to our shared values and dedicated to our customers' mission.

The AT&T Integrity, Compliance & Risk Management Team enables the company to bring secure, resilient, and authorization-ready services to the Public Sector market. Government cybersecurity authorizations are essential to offering and sustaining AT&T solutions for Federal Aviation Administration - Enterprise Network Services (FENS) program.

This role provides the specialized technical leadership needed to translate FISMA, NIST Risk Management Framework, agency policy, and contractual obligations into scalable security practices that protect AT&T, strengthen customer confidence, and reduce business and operational risk. Serving as a trusted interface among product, engineering, operations, executive leadership, and government stakeholders, the Information System Security Engineer (ISSE) will guide services through the full cybersecurity compliance lifecycle-from early architecture and control design through assessment, Authorization to Operate (ATO), continuous monitoring, and ongoing authorization-helping accelerate market access while sustaining defensible security and compliance outcomes.

The Information Systems Security Engineer (ISSE) will serve as the primary manager and technical subject-matter resource for AT&T's Tenable Security Center capability supporting Civilian, Department of Defense, State, and Local Government customers. The ISSE will own the vulnerability-management lifecycle, including scan governance, coverage, finding analysis, risk-based prioritization, remediation coordination, metrics, reporting, and continuous process improvement.

The role will apply deep technical knowledge of enterprise identity, server, virtualization, logging, DNS/IP address management, and network technologies to evaluate exposure, resolve visibility and integration issues, and provide technically credible remediation guidance. Working with infrastructure administrators, security operations teams, system owners, compliance personnel, assessors, and government stakeholders, the ISSE will integrate Tenable results with Xacta-based continuous monitoring, findings, Plans of Action and Milestones, and authorization activities.

The position requires independent technical judgment, strong process ownership, clear documentation and communication skills, and the ability to lead cross-functional vulnerability-management activities while escalating material risks and complex decisions to senior leadership.

Job Duties/Responsibilities:

• Lead and continuously improve the enterprise vulnerability management program using Tenable Security Center, ensuring effective governance, operational oversight, and risk-based security outcomes.
• Manage Tenable Security Center architecture and operations, including scan strategies, repositories, scanners, credentials, policies, schedules, asset inventories, dashboards, reporting, and platform integrations.
• Own the end-to-end vulnerability management lifecycle, including asset onboarding, scanning, validation, prioritization, remediation tracking, exception management, retesting, and closure.
• Integrate Tenable Security Center findings with Xacta 360 and ServiceNow workflows to support continuous monitoring, POA&M management, control evidence, risk tracking, remediation activities, and authorization reporting.
• Analyze vulnerability data, validate findings, identify coverage gaps and credentialing issues, distinguish false positives from actionable risk, and provide remediation guidance to technical teams.
• Translate FISMA, NIST RMF, NIST SP 800-53, agency requirements, and contractual obligations into measurable vulnerability management processes, controls, and governance practices.
• Develop executive dashboards, operational metrics, trend analysis, and decision-ready reporting to communicate security posture, remediation progress, and residual risk.
• Establish and maintain vulnerability management governance, including standard operating procedures, service-level objectives, escalation paths, evidence requirements, quality controls, and accountability mechanisms.
• Leverage expertise in Windows Server, Active Directory, Nutanix, CyberArk, SailPoint, Splunk, Infoblox, Cisco SD-WAN, NetFlow, and IPsec technologies to assess exposure and recommend risk-based remediation strategies.
• Correlate vulnerability information with security events, asset inventories, identity data, privileged-access records, network telemetry, DNS/IPAM information, ServiceNow records, and X