Andrew Morgan
Cyber Security Analyst
- Compensation
- Not disclosed
- Location
- US - Remote
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Contract
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- U.S. citizenship.
- Minimum of five (5) years of relevant cybersecurity experience, including at least three (3) years supporting on-premise or SaaS federal information systems.
- Demonstrated experience preparing and sustaining ATO packages under the NIST Risk Management Framework.
- Working knowledge of NIST SP 800-53, SP 800-37, SP 800-171, and FISMA requirements.
- Proven ability to write clear, audit-ready security policies, procedures, and system documentation.
- Experience managing POA&Ms and coordinating vulnerability remediation with technical teams.
- Active DoD 8140/8570 IAM Level I or IAT Level II baseline certification (e.g., Security+, CASP+, CISSP, or CISM), or the ability to obtain one within 90 days of hire.
- Bachelor's degree in cybersecurity, information systems, or a related field; additional years of relevant experience may substitute for a degree.
- Strong written and verbal communication skills, including briefing senior government stakeholders.
Nice to have
- Active Secret clearance, or the ability to obtain and maintain one; Public Trust eligibility at minimum.
- Experience working with OneStream or other EPM and financial systems (e.g., Oracle Hyperion, SAP BPC, or Anaplan).
- Background supporting federal financial management programs.
- Experience with cloud services, single sign-on and 3rd party integrations
- Familiarity with FedRAMP, DoD Cloud Computing SRG impact levels, and shared-responsibility models for SaaS and cloud-hosted applications.
- Hands-on experience with GRC tools.
- Experience supporting financial statement audits, FISCAM, or OMB A-123 internal control reviews.
- Advanced certifications such as CISSP, CISM, CAP/CGRC, or CCSP.
Full description
Andrew Morgan LLC (AM) is a fast-growing Service-Disabled Veteran-Owned Small Business (SDVOSB). We are currently seeking a qualified Cyber Security Analyst (Federal OneStream Support) to join our team supporting our DoD Federal Client. The analyst will own the security compliance lifecycle for the platform, from authoring policies and procedures through achieving and sustaining the Authority to Operate (ATO).
Working alongside functional, technical, and program teams, the analyst will translate federal security requirements into practical controls for a cloud-based enterprise performance management (EPM) solution. This role suits a hands-on practitioner who is equally comfortable writing a System Security Plan, briefing an Authorizing Official, and reviewing OneStream security roles with administrators.
RESPONSIBILITIES:
- Lead the full RMF lifecycle (NIST SP 800-37) for OneStream systems: categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
- Develop and maintain the ATO package, including the System Security Plan (SSP), Security Assessment Report inputs, Plan of Action and Milestones (POA&M), contingency plan, incident response plan, and configuration management plan.
- Map and document NIST SP 800-53 controls, including inherited controls from FedRAMP-authorized cloud service providers and customer-responsibility controls.
- Coordinate with Security Control Assessors (SCAs), Information System Security Managers (ISSMs), and Authorizing Officials (AOs) to drive packages to authorization.
- Manage artifacts and workflows the GRC tool.
- Author, review, and update system-specific security policies, standard operating procedures (SOPs), and rules of behavior.
- Document access control, account management, audit logging, separation of duties, and data handling procedures tailored to OneStream.
- Align documentation with applicable federal and agency guidance, including DoD Instruction 8510.01, DISA STIGs and SRGs, FISMA, and OMB Circulars A-130 and A-123.
- Track and remediate vulnerabilities and POA&M items with technical teams, ensuring milestones are met and closure evidence is documented.
- Conduct periodic access reviews, security role audits, and user recertifications within OneStream.
- Assess the security impact of system changes, upgrades, and new integrations before deployment.
- Support annual assessments, ATO reauthorizations, and ongoing authorization activities.
- Partner with OneStream team to design and validate the security model, including security groups, roles, cube and workflow access, and data-level restrictions.