Onsite Federal ISSO — RMF, Zero-Trust Security Leader

att; Chantilly (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

AT&T Global Public Sector in Chantilly, VA is seeking an Information System Security Officer (ISSO) to lead NIST RMF lifecycle activities and translate federal cybersecurity mandates into scalable security architectures. You will collaborate with engineering, operations and government stakeholders to secure services from design through authorization and continuous monitoring.

This onsite, full-time role emphasizes Zero Trust, risk-informed decision making, and proactive governance to protect

Responsibilities

• Lead NIST RMF lifecycle activities, including system categorization, control selection and tailoring, implementation, assessment, authorization, continuous monitoring, and ongoing authorization, using Xacta as the authoritative GRC and authorization-management platform.
• Translate FISMA, FEDRAMP, DoD RMF, CMMC, agency policy, and contractual requirements into actionable security control implementation plans, technical standards, security requirements, and operating procedures.
• Develop and quality-assure authorization packages in Xacta, including system security plans, security assessment reports, control implementation statements, privacy artifacts, contingency plans, risk assessments, and supporting evidence.
• Plan and oversee security control assessments, validate that controls operate as documented, identify implementation deficiencies, analyze root causes, and verify corrective actions and supporting evidence within Xacta.
• Lead POA&M governance using Xacta and ServiceNow, ensuring vulnerabilities and control deficiencies identified through assessments, audits, penetration testing, and continuous monitoring are prioritized, assigned, tracked, and remediated within risk-based timelines.
• Establish continuous-compliance and monitoring practices using automated control evidence, security configuration baselines, endpoint telemetry, SIEM capabilities, and vulnerability data from Tenable Security Center.
• Analyze and govern vulnerabilities identified through Tenable Security Center, validate findings, assess risk and asset criticality, coordinate remediation through ServiceNow, and maintain traceability to applicable controls and POA&Ms in Xacta.
• Perform security architecture and design reviews across identity, network, application, data, cloud, and operational security domains to identify control gaps and recommend risk-reduction measures.
• Assess the security impact of system changes, including new technologies, cloud services, APIs, data exchanges, integrations, boundary modifications, and changes to architecture, operations, or data flows.
• Apply Zero Trust and threat-informed risk principles, including strong identity, least privilege, device assurance, segmentation, continuous verification, policy-based access, and compensating controls.
• Integrate security governance into ServiceNow configuration, change, release, incident, and problem-management workflows, including security reviews for infrastructure-as-code and automated deployment pipelines, to prevent unauthorized or noncompliant changes.
• C ommunicate security posture and residual risk to system owners, authorizing officials, governance bodies, and executive stakeholders using risk indicators, compliance trends, vulnerability metrics, POA&M status, mitigation options, and decision-ready information derived from Xacta, Tenable Security Center, and Servic

Job description

AT&T Global Public Sector in Chantilly, VA is seeking an Information System Security Officer (ISSO) to lead NIST RMF lifecycle activities and translate federal cybersecurity mandates into scalable security architectures. You will collaborate with engineering, operations and government stakeholders to secure services from design through authorization and continuous monitoring.

This onsite, full-time role emphasizes Zero Trust, risk-informed decision making, and proactive governance to protect