8+ years of experience in cybersecurity, information assurance, risk management, compliance, or security assessment.
Familiarity with JCAM or similar governance, risk, and compliance tools.
Proven experience validating POA&Ms in federal or regulated environments.
Support experience with NIST RMF authorization activities.
Proficient in analyzing vulnerability scan results from tools like Tenable, Nessus, or Qualys.
Strong grasp of NIST SP 800-53 Security Controls and related frameworks.
Excellent technical writing and documentation skills.
Responsibilities
Conduct independent reviews of POA&Ms for accuracy and compliance.
Validate security weaknesses identified through various assessments and scans.
Evaluate corrective action plans for feasibility and effectiveness.
Verify remediation activities and validate evidence before POA&M closure.
Assess residual risk and recommend appropriate actions.
Perform independent assessments of security controls.
Develop and maintain POA&M dashboards and status reports.
Benefits
Collaborative work environment with cross-functional teams.
Opportunities for professional development and training.
Access to advanced cybersecurity tools and technologies.
Engagement in high-impact projects that enhance organizational security.
Flexible work arrangements to support work-life balance.
Full Job Description
About the role
The Information Security POA&M IV&V Analyst is responsible for conducting independent verification and validation of Plans of Action and Milestones (POA&Ms) to ensure cybersecurity weaknesses, vulnerabilities, and compliance deficiencies are properly documented, remediated, and tracked to closure. The analyst evaluates corrective action plans, validates remediation evidence, assesses compliance with federal cybersecurity requirements, and provides objective risk assessments to support organizational security and authorization activities.
What you'll do
POA&M Validation and Oversight
Conduct independent reviews of POA&Ms to verify accuracy, completeness, and compliance with organizational and regulatory requirements.
Validate security weaknesses identified through assessments, audits, vulnerability scans, penetration tests, and continuous monitoring activities.
Evaluate corrective action plans and associated milestones for feasibility, effectiveness, and risk reduction.
Verify implementation of remediation activities and validate supporting evidence prior to POA&M closure.
Assess residual risk associated with remediated findings and recommend acceptance, mitigation, or escalation.
Independent Verification & Validation (IV&V)
Perform independent assessments of remediation efforts to ensure security controls are operating as intended.
Review technical and procedural evidence, including system configurations, scan results, security documentation, and remediation artifacts.
Conduct follow-up testing to confirm vulnerabilities have been successfully mitigated.
Identify discrepancies between reported remediation status and actual implementation.
Reporting and Metrics
Develop and maintain POA&M dashboards, metrics, and status reports.
Analyze trends in security findings and remediation performance.
Prepare executive-level briefings on POA&M status, risk posture, and remediation effectiveness.
Document findings, recommendations, and validation results in accordance with organizational standards.
Stakeholder Coordination
Collaborate with Information System Security Officers (ISSOs), Information System Owners (ISOs), security assessors, and technical teams.
Facilitate meetings to resolve overdue findings and remediation challenges.
Provide guidance on remediation strategies and POA&M documentation requirements.
Qualifications
8+ years of cybersecurity, information assurance, risk management, compliance, or security assessment experience.
Experience with JCAM or similar governance, risk, and compliance tools.
Experience validating POA&Ms within federal, state, or regulated environments.
