Cyber Security Analyst

Andrew Morgan Consulting LLC; United States; Remote; USD 140,000 - 155,000; Full time

Benefits offered by this job

PTO 15 days + 11 holidays

401K with employer match

Healthcare options

Flexible Spending Account

Life Insurance

Disability Insurance

Training and Development

Team Building Events

Job summary

Andrew Morgan LLC is seeking a Cyber Security Analyst (Federal OneStream Support) to own the security compliance lifecycle for a cloud-based OneStream platform. You will author policies, develop SSPs, and coordinate with officials to obtain and sustain ATO while aligning with NIST, DoD, and FedRAMP requirements.

The role requires hands-on policy writing, documentation, and liaison with government stakeholders. Strong communication and experience with RMF/A-ATO processes are essential.

Qualifications

• U.S. citizenship is required for federal work.
• At least five years of cybersecurity experience, with three in federal information systems.
• Ability to sustain ATO packages under NIST RMF.
• Experience with NIST SP 800-53/800-37/800-171 and FISMA guidance.

Responsibilities

• Lead the full RMF lifecycle (NIST SP 800-37) for OneStream systems.
• Develop and maintain the ATO package and SSP.
• Map NIST controls including FedRAMP-derived controls.
• Coordinate with SCAs, ISSMs, and AOs to drive authorization.
• Manage artifacts and workflows in the GRC tool.
• Author and update security policies and SOPs.
• Document access control and data handling procedures.
• Ensure alignment with DoD 8510.01, DISA STIGs/SRGs, and A-130/A-123 guidance.
• Track and remediate vulnerabilities and POA&M items with teams.
• Conduct periodic access reviews and security role audits.
• Assess security impact of changes and integrations.
• Support annual assessments and reauthorizations.
• Collaborate with OneStream teams to validate security models.

Skills

U.S. citizenship

NIST RMF knowledge

Written communications

Security policy writing

Vulnerability remediation coordination

Education

Bachelor's degree in cybersecurity or related field

IAM baseline certification (DoD 8140/8570) or ability to obtain within 90 days

Tools

GRC tools

Job description

Andrew Morgan LLC (AM) is a fast-growing Service-Disabled Veteran-Owned Small Business (SDVOSB). We are currently seeking a qualified Cyber Security Analyst (Federal OneStream Support) to join our team supporting our DoD Federal Client. The analyst will own the security compliance lifecycle for the platform, from authoring policies and procedures through achieving and sustaining the Authority to Operate (ATO).

Working alongside functional, technical, and program teams, the analyst will translate federal security requirements into practical controls for a cloud-based enterprise performance management (EPM) solution. This role suits a hands-on practitioner who is equally comfortable writing a System Security Plan, briefing an Authorizing Official, and reviewing OneStream security roles with administrators.

RESPONSIBILITIES

• Lead the full RMF lifecycle (NIST SP 800-37) for OneStream systems: categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
• Develop and maintain the ATO package, including the System Security Plan (SSP), Security Assessment Report inputs, Plan of Action and Milestones (POA&M), contingency plan, incident response plan, and configuration management plan.
• Map and document NIST SP 800-53 controls, including inherited controls from FedRAMP-authorized cloud service providers and customer-responsibility controls.
• Coordinate with Security Control Assessors (SCAs), Information System Security Managers (ISSMs), and Authorizing Officials (AOs) to drive packages to authorization.
• Manage artifacts and workflows the GRC tool.
• Author, review, and update system-specific security policies, standard operating procedures (SOPs), and rules of behavior.
• Document access control, account management, audit logging, separation of duties, and data handling procedures tailored to OneStream.
• Align documentation with applicable federal and agency guidance, including DoD Instruction 8510.01, DISA STIGs and SRGs, FISMA, and OMB Circulars A-130 and A-123.
• Track and remediate vulnerabilities and POA&M items with technical teams, ensuring milestones are met and closure evidence is documented.
• Conduct periodic access reviews, security role audits, and user recertifications within OneStream.
• Assess the security impact of system changes, upgrades, and new integrations before deployment.
• Support annual assessments, ATO reauthorizations, and ongoing authorization activities.
• Partner with OneStream team to design and validate the security model, including security groups, roles, cube and workflow access, and data-level restrictions.
• Review integrations with source systems (e.g., Momentum and data warehouses) for secure data transfer and interface controls.
• Confirm audit logging and reporting capabilities meet federal record-keeping and accountability requirements.
• Support financial statement audits and IT general controls (ITGC) reviews, including FISCAM-based testing, by preparing evidence and responding to auditor requests.
• Brief program leadership and government stakeholders on security posture, risks, and remediation status.
• Contribute security content to proposals, project plans, and client deliverables as needed.

REQUIREMENTS

• U.S. citizenship.
• Minimum of five (5) years of relevant cybersecurity experience, including at least three (3) years supporting on-premise or SaaS federal information systems.
• Demonstrated experience preparing and sustaining ATO packages under the NIST Risk Management Framework.
• Working knowledge of NIST SP 800-53, SP 800-37, SP 800-171, and FISMA requirements.
• Proven ability to write clear, audit-ready security policies, procedures, and system documentation.
• Experience managing POA&Ms and coordinating vulnerability remediation with technical teams.
• Active DoD 8140/8570 IAM Level I or IAT Level II baseline certification (e.g., Security+, CASP+, CISSP, or CISM), or the ability to obtain one within 90 days of hire.
• Bachelor’s degree in cybersecurity, information systems, or a related field; additional years of relevant experience may substitute for a degree.
• Strong written and verbal communication skills, including briefing senior government stakeholders.

PREFERRED QUALIFICATIONS

• Active Secret clearance, or the ability to obtain and maintain one; Public Trust eligibility at minimum.
• Experience working with OneStream or other EPM and financial systems (e.g., Oracle Hyperion, SAP BPC, or Anaplan).
• Background supporting federal financial management programs.
• Experience with cloud services, single sign-on and 3rd party integrations
• Familiarity with FedRAMP, DoD Cloud Computing SRG impact levels, and shared-responsibility models for SaaS and cloud-hosted applications.
• Hands-on experience with GRC tools.
• Experience supporting financial statement audits, FISCAM, or OMB A-123 internal control reviews.
• Advanced certifications such as CISSP, CISM, CAP/CGRC, or CCSP.

SALARY

Base Salary: $140,000-$155,000

Salary is commensurate with both location and experience.

THE AM EMPLOYEE WILL DISPLAY…

• Attention to Detail: Produce high-quality deliverables and outputs that align with contract outcomes.
• Self-Sufficiency: Execute tasks independently, seeking client assistance only after internal resources are exhausted, ensuring requests align with contract goals.
• Teamwork: Collaborate effectively with team members, including AMC resources, subcontractors, and government stakeholders.
• Communication/Engagement: Maintain professional conduct in meetings and written communication, participating actively with cameras on.
• Responsiveness: Stay engaged, communicate promptly, and ensure deadlines are consistently met.

ABOUT ANDREW MORGAN…

Andrew Morgan LLC, founded in 2017 and headquartered in Alexandria, VA, is a Service-Disabled Veteran Owned Small Business (SDVOSB). We specialize in delivering high-quality consulting services to both federal and commercial clients, offering expertise in Strategy and Management Consulting, Technology & Architecture Services, and Industry & Mission Analytics Solutions. Our distinguished clientele includes the Department of Veterans Affairs (VA), National Aeronautics and Space Administration (NASA), the Department of Defense (DoD), and the United Stated Army Corps of Engineers (USACE). We are committed to providing innovative solutions and exceptional service to support our clients’ missions and objectives.

BENEFITS

• 15 days of Paid Time Off + 11 Paid Federal Holidays
• 401K Program (up to 4% employer matching)
• Three Gold Healthcare Options (with 75%-90% employer-paid premiums)
• Flexible Spending Account / Dependent Care Assistance Program
• Employer-Paid Short Term Disability Insurance
• Employer-Paid Long Term Disability Insurance
• Employer-Paid Life Insurance
• Professional Training and Development
• Corporate Team Building Events
• And MORE!

EQUAL OPPORTUNITY EMPLOYER

Andrew Morgan does not discriminate in employment opportunities, terms and conditions of employment, or practices. All qualified applicants will receive consideration for employment without regard to race, age, gender, religious or political beliefs, national origin or heritage, disability, sexual orientation, protected veteran status, or any characteristic protected by law.