This is a full-time onsite role based in the location(s) posted and is performed from the designated work location five (5) days per week. No relocation is offered.
AT&T Global Public Sector is a trusted provider of secure, IP enabled, cloud-based, network solutions and professional services to the Federal Government. We are dedicated to recruiting, developing and empowering a diverse, high-performing workforce that is passionate about what they do, committed to our shared values and dedicated to our customers’ mission.
The AT&T Integrity, Compliance & Risk Management Team enables the company to bring secure, resilient, and authorization-ready services to the Public Sector market. Government cybersecurity authorizations are essential to offering and sustaining AT&T solutions for Federal Aviation Administration - Enterprise Network Services (FENS) program.
This role provides the specialized technical leadership needed to translate FISMA, NIST Risk Management Framework, agency policy, and contractual obligations into scalable security practices that protect AT&T, strengthen customer confidence, and reduce business and operational risk. Serving as a trusted interface among product, engineering, operations, executive leadership, and government stakeholders, the Information System Security Officer (ISSO) will guide services through the full cybersecurity compliance lifecycle—from early architecture and control design through assessment, Authorization to Operate (ATO), continuous monitoring, and ongoing authorization—helping accelerate market access while sustaining defensible security and compliance outcomes.
The ISSO role combines strategic influence with hands-on technical expertise to translate evolving federal cybersecurity mandates into scalable security architectures, disciplined operational practices, and successful authorization outcomes. The ISSO will partner across engineering, operations, product, and government stakeholder teams to strengthen cyber-risk decisions, accelerate secure service delivery, and sustain compliance throughout the system lifecycle.
Job Duties/Responsibilities:
Lead NIST RMF lifecycle activities, including system categorization, control selection and tailoring, implementation, assessment, authorization, continuous monitoring, and ongoing authorization, using Xacta as the authoritative GRC and authorization-management platform.
Translate FISMA, FEDRAMP, DoD RMF, CMMC, agency policy, and contractual requirements into actionable security control implementation plans, technical standards, security requirements, and operating procedures.
Develop and quality-assure authorization packages in Xacta, including system security plans, security assessment reports, control implementation statements, privacy artifacts, contingency plans, risk assessments, and supporting evidence.
Plan and oversee security control assessments, validate that controls operate as documented, identify implementation deficiencies, analyze root causes, and verify corrective actions and supporting evidence within Xacta.
Lead POA&M governance using Xacta and ServiceNow, ensuring vulnerabilities and control deficiencies identified through assessments, audits, penetration testing, and continuous monitoring are prioritized, assigned, tracked, and remediated within risk-based timelines.
Establish continuous-compliance and monitoring practices using automated control evidence, security configuration baselines, endpoint telemetry, SIEM capabilities, and vulnerability data from Tenable Security Center.
Analyze and govern vulnerabilities identified through Tenable Security Center, validate findings, assess risk and asset criticality, coordinate remediation through ServiceNow, and maintain traceability to applicable controls and POA&Ms in Xacta.
Perform security architecture and design reviews across identity, network, application, data, cloud, and operational security domains to identify control gaps and recommend risk-reduction measures.
Assess…