ZipRecruiter

Log In

1

Poam Jobs (NOW HIRING)

System One

Senior Security Engineer

Dallas, TX · On-site

$113K - $155K/yr

Maintain accurate POAM records for all security-classified vulnerabilities ensuring * remediation dates, risk classifications, and fix approaches are documented to audit standards required in a ...

Potawatomi Federal Solutions, LLC.

Maintain up to date POAM throughout projects. • Research current Army and TRADOC publications to discover any publication needing updates due to changes in organizations for all publications to be ...

AITS

Information Assurance Engineer

Tampa, FL · On-site

Perform analysis on the POAM from that report and compare it to the previous report. Develop the appropriate mitigation efforts and estimated completion dates and update the POAM that natively ...

E Logic

Network Engineer III

Missoula, MT · On-site

$80K/yr

Actively collaborate with the Information Systems Security Officer (ISSO) to update the network's ATO package and address Plan of Action and Milestones (POAM) resolutions. Attend weekly Vulnerability ...

Donato Technologies, Inc

IBM Curam Developer

Dallas, TX · Remote

$50 - $55/hr

Experience addressing security vulnerabilities and POAM (Plan of Action & Milestones) items * Strong understanding of application development, testing, and support * Excellent communication and ...

County of Monroe

DEPUTY- FULL TIME

Monroe, MI · On-site

$29.55/hr

POAM Deputy General Summary: Under the supervision of a Sergeant or other command officer, patrols the County in order to enforce the laws, investigate criminal activities, police accident scenes ...

previous pagenext page

Showing results 21-40

All JobsPoam Jobs

Poam information

See salary details

$14

$24

$41

How much do poam jobs pay per hour?

As of Aug 6, 2026, the average hourly pay for poam in the United States is $24.25, according to ZipRecruiter salary data. Most workers in this role earn between $18.27 and $26.44 per hour, depending on experience, location, and employer.

What are common challenges faced by POAM managers when managing multiple projects?

POAMs often juggle several projects with competing deadlines and priorities, which can make it challenging to allocate resources and maintain clear communication across teams. Balancing the need for thorough documentation with timely progress reporting—especially in highly regulated environments—requires strong organizational skills and attention to detail. Collaborating with diverse stakeholders, such as technical leads, compliance officers, and executive sponsors, is essential to ensure all program objectives are met and risks are effectively managed. Successful POAMs develop efficient tracking systems and proactive communication strategies to stay ahead of potential issues.

What is a POAM?

POAMs, or Plans of Action and Milestones, are management tools used in cybersecurity and compliance to identify, track, and remediate security weaknesses within an organization’s information systems. They document specific steps needed to address vulnerabilities, assign responsibilities, and set deadlines for completion. POAMs are essential for maintaining compliance with standards such as NIST and FedRAMP, ensuring that organizations have a clear plan to achieve and maintain security requirements.

What skills and qualifications are needed to thrive as a POAM manager?

To thrive as a POAM Manager, you need a solid understanding of cybersecurity compliance frameworks, risk assessment, and project management, typically supported by experience in IT security or compliance roles. Familiarity with tools such as GRC (Governance, Risk, and Compliance) platforms, NIST SP 800-53, and related certification like CISSP or CISA is highly valuable. Strong organizational skills, attention to detail, and effective communication are crucial soft skills for coordinating remediation efforts and reporting to stakeholders. These competencies ensure that security gaps are properly tracked, managed, and remediated to maintain organizational compliance and reduce risk.

What is the difference between Poam vs Network Security Analyst?

AspectPoamNetwork Security Analyst
Required CredentialsTypically security certifications like CISSP, CEH, or CompTIA Security+Same certifications, often with additional network-specific credentials
Work EnvironmentSecurity teams, government agencies, or private firms focusing on security plansIT departments, cybersecurity firms, or corporate security teams
Employer & Industry UsageUsed in security planning and compliance documentationUsed in monitoring, analyzing, and responding to security threats

Poam (Plan of Action and Milestones) and Network Security Analyst roles both require security certifications and work within cybersecurity environments. Poam focuses on security planning and compliance, while Network Security Analysts actively monitor and respond to security threats. Both roles are essential in maintaining organizational security but serve different functions within the cybersecurity landscape.

More about Poam jobs
What states have the most Poam jobs? States with the most job openings for Poam jobs include:
What job categories do people searching Poam jobs look for? The top searched job categories for Poam jobs are:
Poam jobs near you
Infographic showing various Poam job openings in the United States as of August 2026, with employment types broken down into 87% Full Time, 4% Part Time, and 9% Contract. Highlights an 91% Physical, 1% Hybrid, and 8% Remote job distribution, with an average salary of $50,446 per year, or $24.3 per hour.

Senior Security Engineer

System One

Dallas, TX • On-site

$113K - $155K/yr

Other

Re-posted 7 days ago

Job description

Job Title: Senior Security Engineer

Duration : Full Time Location : Cleveland, OH, Pittsburgh, PA, or Dallas, TX. Work Mode : 5 Days Onsite Years Of Exp : 8+ Yrs Future duties and responsibilities

  • Vulnerability Triage and Risk Assessment
  • Own security-specific vulnerability triage within the assigned execution crew — reviewing access control, privilege escalation, identity, and container security findings in the vulnerability management platform and making accurate risk assessments before routing to remediation.
  • Identify false positives, risk acceptances, and exception cases that require security judgment rather than standard runbook execution.
  • Validate risk scores against asset criticality and business context, re-scoring where automated triage requires human security expertise.
  • Provide security sign-off on remediation approaches proposed by infrastructure and application engineers before high-risk fixes proceed to change management review.
  • Access Control and Identity Remediation
  • Remediate privilege escalation vulnerabilities across application, database, and container layers reviewing and revoking excessive service account permissions, cleaning up orphaned accounts, and enforcing least-privilege standards aligned to enterprise IAM governance.
  • .Own credential and secrets management remediation for application and database credentials flagged in vulnerability scans coordinating with the platform team for vault integration and ensuring credentials are remediated within approved workflows.
  • Remediate IAM misconfigurations surfaced through vulnerability scans — role-based access violations, dormant privileged accounts, and unauthorized elevation paths.
  • Support quarterly access review processes for CGI-managed service accounts and automation pipeline credentials.
  • Container and Application Security
  • Own container security vulnerability triage reviewing Docker image CVEs, runtime security alerts, and container platform security findings routed from the centralized triage function.
  • Perform container configuration reviews against enterprise security standards and flag non-compliant configurations for remediation.
  • Create fix PRs for container-level vulnerabilities within the source control workflow, adhering to branching standards and pipeline configurations.
  • Review and validate application security fix approaches proposed by Java and .NET
  • developers specifically Spring Security misconfigurations, endpoint exposure vulnerabilities, OAuth misconfigurations, and API security gaps providing security perspective before fixes proceed to application team sign-off.
  • Security Governance and Compliance
  • . Maintain accurate POAM records for all security-classified vulnerabilities ensuring
  • remediation dates, risk classifications, and fix approaches are documented to audit standards required in a regulated banking environment.
  • . Prepare security evidence packages for regulatory audit requests pulling remediation history and pipeline execution logs from the vulnerability management platform and work management tools.
  • .Identify and document risk acceptances for vulnerabilities that cannot be remediated within SLA windows, preparing justifications for information security sign-off.
  • Support the change management process for security-classified changes by preparing security impact assessments for high-risk remediations.
  • Collaboration and Escalation
  • Work closely with Infrastructure Engineers, Java and .NET Developers, Database
  • Administrators, and DevSecOps Engineers across all three crews providing security expertise that these roles do not own individually.
  • .Escalate Critical and High severity security vulnerabilities immediately upon identification, providing technical context and recommended remediation approach to enable rapid response within defined SLA windows.
  • Provide weekly security posture updates to the Delivery Manager covering open high-risk
  • items, overdue security remediations, and emerging threat patterns from CISA KEV and vendor advisories.
Required Qualifications:
  • 6+ years of security engineering or security operations experience in enterprise environments with direct vulnerability remediation responsibility
  • Vulnerability management platform experience POAM management, vulnerability record lifecycle, risk acceptance workflows, and reporting in a production environment
  • Privileged access management and secrets management CyberArk or equivalent vault-based credential governance in an enterprise environment
  • Access control and identity remediation privilege escalation CVE remediation, IAM misconfiguration fixes, service account cleanup, and least-privilege enforcement at scale
  • Container security scanning experience alert triage, container vulnerability assessment, and integration with downstream remediation workflows
  • Application security knowledge Spring Security, OAuth, endpoint exposure vulnerabilities, and API security misconfigurations sufficient to review and validate developer-proposed fixes
  • ITSM experience change request management and security-classified change workflow navigation in a regulated environment
  • Banking or financial services background understanding of regulatory audit evidence requirements, change advisory board processes, and production deployment governance in a regulated context
Required Skills:
  • Access Management
  • Container Technology
  • Vulnerability coordination
  • Bankin
Preferred Qualifications
  • Tanium, Sysdig, or SecurityCenter operational experience
  • Java or Spring Boot security awareness sufficient to review application-level fix approaches
  • OCP or Kubernetes container security depth runtime security and image hardening
  • Jira and Confluence proficiency in a sprint-based delivery model
Ref: #404-IT Pittsburgh