POA&M IV&V Analyst

Saliense; McLean (VA); On-site; USD 120,000 - 170,000; Full time

Benefits offered by this job

20 Days PTO + 40 Hours of Paid Sick &

Health, Vision, Dental, and Life

401(k) with Tiered Match & 100% Vestig

Parental Leave for Birthing and Non-Bi

Professional Development Reimbursement

Job summary

Saliense is seeking an experienced Information Security POA&M IV&V Analyst in McLean, VA. You will independently verify and validate Plans of Action and Milestones, ensuring cybersecurity weaknesses and compliance gaps are properly documented, remediated, and tracked to closure.

You will evaluate remediation evidence, assess residual risk, and support RMF/NIST processes while coordinating with ISSOs, ISOs, and technical teams. Strong writing and analytical skills are essential.

Qualifications

• 8+ years of cybersecurity, information assurance, risk management, compliance, or security assessment experience.

Responsibilities

• Conduct independent verification and validation of POA&Ms to ensure weaknesses and deficiencies are documented and tracked to closure.

Skills

Cybersecurity

Risk management

Compliance

Security assessment

Federal standards

Tools

JCAM

Tenable

Nessus

Invicti

Qualys

Google Wiz

Nucleus

Job description

At Saliense, we are committed to fostering a culture of continuous learning and professional growth. Our employees are encouraged to take on challenging and meaningful work, with ample opportunities for career advancement. We offer competitive compensation and benefits, including:

• 20 Days PTO + 40 Hours of Paid Sick & Safe Time
• Health, Vision, Dental, and Life Insurance
• 401(k) with Tiered Match & 100% Vesting
• Parental Leave for Birthing and Non-Birthing Parents
• Professional Development Reimbursement Program

We believe in empowering our team members to achieve their professional goals while contributing to impactful projects that make a difference. Join us at Saliense and be part of a growing organization dedicated to innovation, collaboration, and excellence. Visit www.saliense.com to learn more.

There are many more - connect with us to get a preview of the full benefits package.

About the role

• The Information Security POA&M IV&V Analyst is responsible for conducting independent verification and validation of Plans of Action and Milestones (POA&Ms) to ensure cybersecurity weaknesses, vulnerabilities, and compliance deficiencies are properly documented, remediated, and tracked to closure. The analyst evaluates corrective action plans, validates remediation evidence, assesses compliance with federal cybersecurity requirements, and provides objective risk assessments to support organizational security and authorization activities.

What you'll do

POA&M Validation and Oversight

• Conduct independent reviews of POA&Ms to verify accuracy, completeness, and compliance with organizational and regulatory requirements.
• Validate security weaknesses identified through assessments, audits, vulnerability scans, penetration tests, and continuous monitoring activities.
• Evaluate corrective action plans and associated milestones for feasibility, effectiveness, and risk reduction.
• Verify implementation of remediation activities and validate supporting evidence prior to POA&M closure.
• Assess residual risk associated with remediated findings and recommend acceptance, mitigation, or escalation.
• Perform independent assessments of remediation efforts to ensure security controls are operating as intended.
• Review technical and procedural evidence, including system configurations, scan results, security documentation, and remediation artifacts.
• Conduct follow-up testing to confirm vulnerabilities have been successfully mitigated.
• Identify discrepancies between reported remediation status and actual implementation.

Reporting and Metrics

• Develop and maintain POA&M dashboards, metrics, and status reports.
• Analyze trends in security findings and remediation performance.
• Prepare executive-level briefings on POA&M status, risk posture, and remediation effectiveness.
• Document findings, recommendations, and validation results in accordance with organizational standards.

Stakeholder Coordination

• Collaborate with Information System Security Officers (ISSOs), Information System Owners (ISOs), security assessors, and technical teams.
• Facilitate meetings to resolve overdue findings and remediation challenges.
• Provide guidance on remediation strategies and POA&M documentation requirements.

Qualifications

• 8+ years of cybersecurity, information assurance, risk management, compliance, or security assessment experience.
• Experience with JCAM or similar governance, risk, and compliance tools.
• Experience validating POA&Ms within federal, state, or regulated environments.
• Experience supporting NIST RMF authorization activities.
• Experience analyzing vulnerability scan results from tools such as Tenable, Nessus, Invicti, Qualys, Google Wiz, Nucleus or similar platforms.
• Strong understanding of NIST SP 800-53 Security Controls, NIST Risk Management Framework (RMF), NIST SP 800-37, NIST SP 800-53A Assessment Procedures, FISMA requirements, Continuous Monitoring (ConMon) processes.
• Ability to assess and validate remediation evidence.
• Strong technical writing and documentation skills.
• Excellent analytical, problem-solving, and communication abilities.