jobapplier

POA&M IV&V Analyst

Saliense

About Saliense

  • Saliense At Saliense, we are committed to fostering a culture of continuous learning and professional growth.
  • Join us at Saliense and be part of a growing organization dedicated to innovation, collaboration, and excellence.
  • Visit www.saliense.com to learn more.
  • There are many more - connect with us to get a preview of the full benefits package.

Responsibilities

  • Information Security POA&M IV&V Analyst is responsible for conducting independent verification and validation of Plans of Action and Milestones (POA&Ms) to ensure cybersecurity weaknesses, vulnerabilities, and compliance deficiencies are properly documented, remediated, and tracked to closure.
  • The analyst evaluates corrective action plans, validates remediation evidence, assesses compliance with federal cybersecurity requirements, and provides objective risk assessments to support organizational security and authorization activities.
  • What you'll do POA&M Validation and Oversight Conduct independent reviews of POA&Ms to verify accuracy, completeness, and compliance with organizational and regulatory requirements.
  • Validate security weaknesses identified through assessments, audits, vulnerability scans, penetration tests, and continuous monitoring activities.
  • Evaluate corrective action plans and associated milestones for feasibility, effectiveness, and risk reduction.
  • Verify implementation of remediation activities and validate supporting evidence prior to POA&M closure.
  • Assess residual risk associated with remediated findings and recommend acceptance, mitigation, or escalation.
  • Independent Verification & Validation (IV&V) Perform independent assessments of remediation efforts to ensure security controls are operating as intended.
  • Review technical and procedural evidence, including system configurations, scan results, security documentation, and remediation artifacts.
  • Conduct follow-up testing to confirm vulnerabilities have been successfully mitigated.
  • Identify discrepancies between reported remediation status and actual implementation.
  • Reporting and Metrics Develop and maintain POA&M dashboards, metrics, and status reports.
  • Analyze trends in security findings and remediation performance.
  • Prepare executive-level briefings on POA&M status, risk posture, and remediation effectiveness.
  • Document findings, recommendations, and validation results in accordance with organizational standards.
  • Collaborate with Information System Security Officers (ISSOs), Information System Owners (ISOs), security assessors, and technical teams.
  • Facilitate meetings to resolve overdue findings and remediation challenges.
  • Provide guidance on remediation strategies and POA&M documentation requirements.

Requirements

  • Qualifications 8+ years of cybersecurity, information assurance, risk management, compliance, or security assessment experience.
  • Experience with JCAM or similar governance, risk, and compliance tools.
  • Experience validating POA&Ms within federal, state, or regulated environments.
  • Experience supporting NIST RMF authorization activities.
  • Experience analyzing vulnerability scan results from tools such as Tenable, Nessus, Invicti, Qualys, Google Wiz, Nucleus or similar platforms.
  • Strong understanding of NIST SP 800-53 Security Controls, NIST Risk Management Framework (RMF), NIST SP 800-37, NIST SP 800-53A Assessment Procedures, FISMA requirements, Continuous Monitoring (ConMon) processes.
  • Ability to assess and validate remediation evidence.
  • Strong technical writing and documentation skills.
  • Excellent analytical, problem-solving, and communication abilities.

Benefits

  • Our employees are encouraged to take on challenging and meaningful work, with ample opportunities for career advancement.
  • We offer competitive compensation and benefits, including: 20 Days PTO + 40 Hours of Paid Sick & Safe Time 11 Federal Holidays + 2 Corporate Holidays Health, Vision, Dental, and Life Insurance 401(k) with Tiered Match & 100% Vesting Parental Leave for Birthing and Non-Birthing Parents Professional Development Reimbursement Program We believe in empowering our team members to achieve their professional goals while contributing to impactful projects that make a difference.