Cyber Security Analyst

Andrew Morgan LLC (AM) is a fast-growing Service-Disabled Veteran-Owned Small Business (SDVOSB). We are currently seeking a qualified Cyber Security Analyst (Federal OneStream Support)  to join our team supporting our DoD Federal Client. The analyst will own the security compliance lifecycle for the platform, from authoring policies and procedures through achieving and sustaining the Authority to Operate (ATO).

Working alongside functional, technical, and program teams, the analyst will translate federal security requirements into practical controls for a cloud-based enterprise performance management (EPM) solution. This role suits a hands-on practitioner who is equally comfortable writing a System Security Plan, briefing an Authorizing Official, and reviewing OneStream security roles with administrators.

RESPONSIBILITIES:

• Lead the full RMF lifecycle (NIST SP 800-37) for OneStream systems: categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
• Develop and maintain the ATO package, including the System Security Plan (SSP), Security Assessment Report inputs, Plan of Action and Milestones (POA&M), contingency plan, incident response plan, and configuration management plan.
• Map and document NIST SP 800-53 controls, including inherited controls from FedRAMP-authorized cloud service providers and customer-responsibility controls.
• Coordinate with Security Control Assessors (SCAs), Information System Security Managers (ISSMs), and Authorizing Officials (AOs) to drive packages to authorization.
• Manage artifacts and workflows the GRC tool.
• Author, review, and update system-specific security policies, standard operating procedures (SOPs), and rules of behavior.
• Document access control, account management, audit logging, separation of duties, and data handling procedures tailored to OneStream.
• Align documentation with applicable federal and agency guidance, including DoD Instruction 8510.01, DISA STIGs and SRGs, FISMA, and OMB Circulars A-130 and A-123.
• Track and remediate vulnerabilities and POA&M items with technical teams, ensuring milestones are met and closure evidence is documented.
• Conduct periodic access reviews, security role audits, and user recertifications within OneStream.
• Assess the security impact of system changes, upgrades, and new integrations before deployment.
• Support annual assessments, ATO reauthorizations, and ongoing authorization activities.
• Partner with OneStream team to design and validate the security model, including security groups, roles, cube and workflow access, and data-level restrictions.
• Review integrations with source systems (e.g., Momentum and data warehouses) for secure data transfer and interface controls.
• Confirm audit logging and reporting capabilities meet federal record-keeping and accountability requirements.
• Support financial statement audits and IT general controls (ITGC) reviews, including FISCAM-based testing, by preparing evidence and responding to auditor requests.
• Brief program leadership and government stakeholders on security posture, risks, and remediation status.
• Contribute security content to proposals, project plans, and client deliverables as needed.

REQUIREMENTS:

• U.S. citizenship.
• Minimum of five (5) years of relevant cybersecurity experience, including at least three (3) years supporting on-premise or SaaS federal information systems. 
• Demonstrated experience preparing and sustaining ATO packages under the NIST Risk Management Framework.
• Working knowledge of NIST SP 800-53, SP 800-37, SP 800-171, and FISMA requirements.
• Proven ability to write clear, audit-ready security policies, procedures, and system documentation.
• Experience managing POA&Ms and coordinating vulnerability remediation with technical teams.
• Active DoD 8140/8570 IAM Level I or IAT Level II baseline certification (e.g., Security+, CASP+, CISSP, or CISM), or the ability to obtain one within 90 days of hire.
• Bachelor's degree in cybersecurity, information systems, or a related field; additional years of relevant experience may substitute for a degree.
• Strong written and verbal communication skills, including briefing senior government stakeholders.

PREFERRED QUALIFICATIONS:

• Active Secret clearance, or the ability to obtain and maintain one; Public Trust eligibility at minimum.
• Experience working with OneStream or other EPM and financial systems (e.g., Oracle Hyperion, SAP BPC, or Anaplan).
• Background supporting federal financial management programs.
• Experience with cloud services, single sign-on and 3rd party integrations
• Familiarity with FedRAMP, DoD Cloud Computing SRG impact levels, and shared-responsibility models for SaaS and cloud-hosted applications.
• Hands-on experience with GRC tools.
• Experience supporting financial statement audits, FISCAM, or OMB A-123 internal control reviews.
• Advanced certifications such as CISSP, CISM, CAP/CGRC, or CCSP.

SALARY:

Base Salary: $140,000-$155,000

Salary is commensurate with both location and experience.

THE AM EMPLOYEE WILL DISPLAY…

• Attention to Detail: Produce high-quality deliverables and outputs that align with contract outcomes.
• Self-Sufficiency: Execute tasks independently, seeking client assistance only after internal resources are exhausted, ensuring requests align with contract goals.
• Teamwork: Collaborate effectively with team members, including AMC resources, subcontractors, and government stakeholders.
• Communication/Engagement: Maintain professional conduct in meetings and written communication, participating actively with cameras on.
• Responsiveness: Stay engaged, communicate promptly, and ensure deadlines are consistently met.

ABOUT ANDREW MORGAN…

Andrew Morgan LLC, founded in 2017 and headquartered in Alexandria, VA, is a Service-Disabled Veteran Owned Small Business (SDVOSB). We specialize in delivering high-quality consulting services to both federal and commercial clients, offering expertise in Strategy and Management Consulting, Technology & Architecture Services, and Industry & Mission Analytics Solutions. Our distinguished clientele includes the Department of Veterans Affairs (VA), National Aeronautics and Space Administration (NASA), the Department of Defense (DoD), and the United Stated Army Corps of Engineers (USACE). We are committed to providing innovative solutions and exceptional service to support our clients' missions and objectives.

BENEFITS:

• 15 days of Paid Time Off + 11 Paid Federal Holidays
• 401K Program (up to 4% employer matching)
• Three Gold Healthcare Options (with 75%-90% employer-paid premiums)
• Flexible Spending Account / Dependent Care Assistance Program
• Employer-Paid Short Term Disability Insurance
• Employer-Paid Long Term Disability Insurance
• Employer-Paid Life Insurance
• Professional Training and Development
• Corporate Team Building Events
• And MORE!

EQUAL OPPORTUNITY EMPLOYER:

Andrew Morgan does not discriminate in employment opportunities, terms and conditions of employment, or practices. All qualified applicants will receive consideration for employment without regard to race, age, gender, religious or political beliefs, national origin or heritage, disability, sexual orientation, protected veteran status, or any characteristic protected by law.