POA&M IV&V Analyst

Saliense•McLean, VA

11d

About The Position

The Information Security POA&M IV&V Analyst conducts independent verification and validation of Plans of Action and Milestones (POA&Ms) to ensure cybersecurity weaknesses, vulnerabilities, and compliance deficiencies are properly documented, remediated, and tracked to closure. The analyst evaluates corrective action plans, validates remediation evidence, assesses compliance with federal cybersecurity requirements, and provides objective risk assessments supporting organizational security and authorization activities. The role includes reviewing POA&Ms for accuracy and completeness, validating findings and remediation evidence, conducting follow-up testing, assessing residual risk, and identifying discrepancies between reported remediation status and actual implementation. The analyst also develops dashboards and reports, analyzes remediation trends, prepares executive briefings, documents validation results, and coordinates with security and technical stakeholders to address overdue findings and remediation challenges.

Requirements

At least 8 years of experience in cybersecurity, information assurance, risk management, compliance, or security assessment.
Experience with JCAM or similar governance, risk, and compliance tools.
Experience validating POA&Ms within federal, state, or regulated environments.
Experience supporting NIST RMF authorization activities.
Experience analyzing vulnerability scan results from tools such as Tenable, Nessus, Invicti, Qualys, Google Wiz, Nucleus, or similar platforms.
Strong understanding of NIST SP 800-53 Security Controls, NIST Risk Management Framework (RMF), NIST SP 800-37, NIST SP 800-53A Assessment Procedures, FISMA requirements, and Continuous Monitoring (ConMon) processes.
Ability to assess and validate remediation evidence.
Strong technical writing and documentation skills.
Excellent analytical, problem-solving, and communication abilities.

Responsibilities

Conduct independent reviews of POA&Ms to verify accuracy, completeness, and compliance with organizational and regulatory requirements.
Validate security weaknesses identified through assessments, audits, vulnerability scans, penetration tests, and continuous monitoring activities.
Evaluate corrective action plans and milestones for feasibility, effectiveness, and risk reduction.
Verify remediation activities and validate supporting evidence before POA&M closure.
Assess residual risk associated with remediated findings and recommend acceptance, mitigation, or escalation.
Perform independent assessments of remediation efforts to ensure security controls operate as intended.
Review technical and procedural evidence, including system configurations, scan results, security documentation, and remediation artifacts.
Conduct follow-up testing to confirm vulnerabilities have been mitigated.
Identify discrepancies between reported remediation status and actual implementation.
Develop and maintain POA&M dashboards, metrics, and status reports.
Analyze trends in security findings and remediation performance.
Prepare executive-level briefings on POA&M status, risk posture, and remediation effectiveness.
Document findings, recommendations, and validation results in accordance with organizational standards.
Collaborate with Information System Security Officers (ISSOs), Information System Owners (ISOs), security assessors, and technical teams.
Facilitate meetings to resolve overdue findings and remediation challenges.
Provide guidance on remediation strategies and POA&M documentation requirements.