POA&M IV&V Analyst

About the role

• The Information Security POA&M IV&V Analyst is responsible for conducting independent verification and validation of Plans of Action and Milestones (POA&Ms) to ensure cybersecurity weaknesses, vulnerabilities, and compliance deficiencies are properly documented, remediated, and tracked to closure. The analyst evaluates corrective action plans, validates remediation evidence, assesses compliance with federal cybersecurity requirements, and provides objective risk assessments to support organizational security and authorization activities.

What you'll do

POA&M Validation and Oversight

• Conduct independent reviews of POA&Ms to verify accuracy, completeness, and compliance with organizational and regulatory requirements.
• Validate security weaknesses identified through assessments, audits, vulnerability scans, penetration tests, and continuous monitoring activities.
• Evaluate corrective action plans and associated milestones for feasibility, effectiveness, and risk reduction.
• Verify implementation of remediation activities and validate supporting evidence prior to POA&M closure.
• Assess residual risk associated with remediated findings and recommend acceptance, mitigation, or escalation.

Independent Verification & Validation (IV&V)

• Perform independent assessments of remediation efforts to ensure security controls are operating as intended.
• Review technical and procedural evidence, including system configurations, scan results, security documentation, and remediation artifacts.
• Conduct follow-up testing to confirm vulnerabilities have been successfully mitigated.
• Identify discrepancies between reported remediation status and actual implementation.

Reporting and Metrics

• Develop and maintain POA&M dashboards, metrics, and status reports.
• Analyze trends in security findings and remediation performance.
• Prepare executive-level briefings on POA&M status, risk posture, and remediation effectiveness.
• Document findings, recommendations, and validation results in accordance with organizational standards.

Stakeholder Coordination

• Collaborate with Information System Security Officers (ISSOs), Information System Owners (ISOs), security assessors, and technical teams.
• Facilitate meetings to resolve overdue findings and remediation challenges.
• Provide guidance on remediation strategies and POA&M documentation requirements.

Qualifications

• 8+ years of cybersecurity, information assurance, risk management, compliance, or security assessment experience.
• Experience with JCAM or similar governance, risk, and compliance tools.
• Experience validating POA&Ms within federal, state, or regulated environments.
• Experience supporting NIST RMF authorization activities.
• Experience analyzing vulnerability scan results from tools such as Tenable, Nessus, Invicti, Qualys, Google Wiz, Nucleus or similar platforms.
• Strong understanding of NIST SP 800-53 Security Controls, NIST Risk Management Framework (RMF), NIST SP 800-37, NIST SP 800-53A Assessment Procedures, FISMA requirements, Continuous Monitoring (ConMon) processes.
• Ability to assess and validate remediation evidence.
• Strong technical writing and documentation skills.
• Excellent analytical, problem-solving, and communication abilities.