Note: The job is a remote job and is open to candidates in USA. Andrew Morgan LLC is seeking a Cyber Security Analyst to support its DoD federal client. The analyst will manage the security compliance lifecycle for a cloud-based OneStream enterprise performance management solution, including RMF implementation, ATO documentation, security controls, and ongoing assessments.
Responsibilities
- Lead the full RMF lifecycle (NIST SP 800-37) for OneStream systems: categorization, control selection, implementation, assessment, authorization, and continuous monitoring
- Develop and maintain the ATO package, including the System Security Plan (SSP), Security Assessment Report inputs, Plan of Action and Milestones (POA&M), contingency plan, incident response plan, and configuration management plan
- Map and document NIST SP 800-53 controls, including inherited controls from FedRAMP-authorized cloud service providers and customer-responsibility controls
- Coordinate with Security Control Assessors (SCAs), Information System Security Managers (ISSMs), and Authorizing Officials (AOs) to drive packages to authorization
- Manage artifacts and workflows the GRC tool
- Author, review, and update system-specific security policies, standard operating procedures (SOPs), and rules of behavior
- Document access control, account management, audit logging, separation of duties, and data handling procedures tailored to OneStream
- Align documentation with applicable federal and agency guidance, including DoD Instruction 8510.01, DISA STIGs and SRGs, FISMA, and OMB Circulars A-130 and A-123
- Track and remediate vulnerabilities and POA&M items with technical teams, ensuring milestones are met and closure evidence is documented
- Conduct periodic access reviews, security role audits, and user recertifications within OneStream
- Assess the security impact of system changes, upgrades, and new integrations before deployment
- Support annual assessments, ATO reauthorizations, and ongoing authorization activities
- Partner with OneStream team to design and validate the security model, including security groups, roles, cube and workflow access, and data-level restrictions
- Review integrations with source systems (e.g., Momentum and data warehouses) for secure data transfer and interface controls
- Confirm audit logging and reporting capabilities meet federal record-keeping and accountability requirements
- Support financial statement audits and IT general controls (ITGC) reviews, including FISCAM-based testing, by preparing evidence and responding to auditor requests
- Brief program leadership and government stakeholders on security posture, risks, and remediation status
- Contribute security content to proposals, project plans, and client deliverables as needed
Skills
- U.S. citizenship
- Minimum of five (5) years of relevant cybersecurity experience, including at least three (3) years supporting on-premise or SaaS federal information systems
- Demonstrated experience preparing and sustaining ATO packages under the NIST Risk Management Framework
- Working knowledge of NIST SP 800-53, SP 800-37, SP 800-171, and FISMA requirements
- Proven ability to write clear, audit-ready security policies, procedures, and system documentation
- Experience managing POA&Ms and coordinating vulnerability remediation with technical teams
- Active DoD 8140/8570 IAM Level I or IAT Level II baseline certification (e.g., Security+, CASP+, CISSP, or CISM), or the ability to obtain one within 90 days of hire
- Bachelor's degree in cybersecurity, information systems, or a related field; additional years of relevant experience may substitute for a degree
- Strong written and verbal communication skills, including briefing senior government stakeholders
- Active Secret clearance, or the ability to obtain and maintain one; Public Trust eligibility at minimum
- Experience working with OneStream or other EPM and financial systems (e.g., Oracle Hyperion, SAP BPC, or Anaplan)
- Background supporting federal financial management programs
- Experience with cloud services, single sign-on and 3rd party integrations
- Familiarity with FedRAMP, DoD Cloud Computing SRG impact levels, and shared-responsibility models for SaaS and cloud-hosted applications
- Hands-on experience with GRC tools
- Experience supporting financial statement audits, FISCAM, or OMB A-123 internal control reviews
- Advanced certifications such as CISSP, CISM, CAP/CGRC, or CCSP
Benefits
- 15 days of Paid Time Off + 11 Paid Federal Holidays
- 401K Program (up to 4% employer matching)
- Three Gold Healthcare Options (with 75%-90% employer-paid premiums)
- Flexible Spending Account / Dependent Care Assistance Program
- Employer-Paid Short Term Disability Insurance
- Employer-Paid Long Term Disability Insurance
- Employer-Paid Life Insurance
- Professional Training and Development
- Corporate Team Building Events
Company Overview