Information System Security Officer – Government

AT&T

. Lead NIST RMF lifecycle activities, including system categorization, control selection and tailoring, implementation, assessment, authorization, continuous monitoring, and ongoing authorization, using Xacta as the authoritative GRC and authorization-management platform .

Posted 10/20/2026full-timeChantilly • Virginia • United StatesMid-LevelSenior💰 $143,800 - $215,800 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading NIST RMF lifecycle activities and implementing security controls in compliance with FISMA, FEDRAMP, and CMMC standards. Proficient in utilizing Xacta and ServiceNow for governance, risk management, and compliance processes.

Highest-signal resume keywords

NIST RMF Lifecycle ManagementXacta 360 ProficiencyTenable Security Center ExperienceCISSP CertificationIdentity And Access Management Expertise

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security Control ImplementationRisk AssessmentControl Selection And TailoringContinuous MonitoringSecurity Architecture ReviewsAutomated Control EvidenceVulnerability ManagementZero Trust PrinciplesCompliance MonitoringTechnical Standards Development

Soft Skills

Communication SkillsAnalytical ThinkingProblem-Solving

Tools & Technologies

XactaServiceNowTenable Security CenterSIEM CapabilitiesAutomated Deployment Pipelines

Certifications & Qualifications

CISSPCSMSec+

Industry Keywords

FISMAFEDRAMPCMMCPublic Trust ClearanceGovernance, Risk, And Compliance

Tech Stack

Tools & technologies

CloudServiceNow

About the role

Key responsibilities & impact

Lead NIST RMF lifecycle activities, including system categorization, control selection and tailoring, implementation, assessment, authorization, continuous monitoring, and ongoing authorization, using Xacta as the authoritative GRC and authorization-management platform
Translate FISMA, FEDRAMP, DoD RMF, CMMC, agency policy, and contractual requirements into actionable security control implementation plans, technical standards, security requirements, and operating procedures
Develop and quality-assure authorization packages in Xacta, including system security plans, security assessment reports, control implementation statements, privacy artifacts, contingency plans, risk assessments, and supporting evidence
Plan and oversee security control assessments, validate control operation, identify deficiencies, analyze root causes, and verify corrective actions and evidence in Xacta
Lead POA&M governance using Xacta and ServiceNow, prioritizing, assigning, tracking, and remediating vulnerabilities and control deficiencies
Establish continuous-compliance and monitoring practices using automated control evidence, security configuration baselines, endpoint telemetry, SIEM capabilities, and Tenable Security Center vulnerability data
Analyze and govern Tenable Security Center vulnerabilities, assess risk and asset criticality, coordinate remediation through ServiceNow, and maintain traceability to controls and POA&Ms in Xacta
Perform security architecture and design reviews across identity, network, application, data, cloud, and operational security domains
Assess security impacts of system changes, including cloud services, APIs, data exchanges, integrations, boundary modifications, architecture, operations, and data flows
Apply Zero Trust and threat-informed risk principles, including strong identity, least privilege, device assurance, segmentation, continuous verification, policy-based access, and compensating controls
Integrate security governance into ServiceNow configuration, change, release, incident, and problem-management workflows, including security reviews for infrastructure-as-code and automated deployment pipelines
Communicate security posture and residual risk to system owners, authorizing officials, governance bodies, executive stakeholders, and government stakeholders using risk indicators, compliance trends, vulnerability metrics, POA&M status, mitigation options, and decision-ready information

Requirements

What you’ll need

Bachelor’s degree
Must have an active CISSP
Public Trust clearance requirement
Advanced proficiency with Xacta 360 or comparable governance, risk, and compliance platforms
Hands-on experience with Tenable Security Center and enterprise vulnerability management practices
Working knowledge of the ServiceNow ecosystem, including GRC and vulnerability management
Strong expertise in identity and access management
Experience with FEDRAMP and CMMC Certification Process and the deployment of certified cloud service offers
CSM and Sec+ are desired qualifications

Benefits

Comp & perks

Medical/Dental/Vision coverage
401(k) plan
Tuition reimbursement program
Paid Time Off and Holidays (based on date of hire, at least 23 days of vacation each year and 9 company-designated holidays)
Paid Parental Leave
Paid Caregiver Leave
Additional sick leave beyond what state and local law require may be available but is unprotected
Adoption Reimbursement
Disability Benefits (short term and long term)
Life and Accidental Death Insurance
Supplemental benefit programs: critical illness/accident hospital indemnity/group legal
Employee Assistance Programs (EAP)
Extensive employee wellness programs
Employee discounts up to 50% off on eligible AT&T mobility plans and accessories, AT&T internet (and fiber where available) and AT&T phone
No relocation is offered