Cyber Security Analyst

Andrew Morgan LLC is seeking a Cyber Security Analyst to support its DoD federal client. The analyst will manage the security compliance lifecycle for a cloud-based OneStream enterprise performance management solution, including RMF implementation, ATO documentation, security controls, and ongoing assessments.

Responsibilities:

• Lead the full RMF lifecycle (NIST SP 800-37) for OneStream systems: categorization, control selection, implementation, assessment, authorization, and continuous monitoring
• Develop and maintain the ATO package, including the System Security Plan (SSP), Security Assessment Report inputs, Plan of Action and Milestones (POA&M), contingency plan, incident response plan, and configuration management plan
• Map and document NIST SP 800-53 controls, including inherited controls from FedRAMP-authorized cloud service providers and customer-responsibility controls
• Coordinate with Security Control Assessors (SCAs), Information System Security Managers (ISSMs), and Authorizing Officials (AOs) to drive packages to authorization
• Manage artifacts and workflows the GRC tool
• Author, review, and update system-specific security policies, standard operating procedures (SOPs), and rules of behavior
• Document access control, account management, audit logging, separation of duties, and data handling procedures tailored to OneStream
• Align documentation with applicable federal and agency guidance, including DoD Instruction 8510.01, DISA STIGs and SRGs, FISMA, and OMB Circulars A-130 and A-123
• Track and remediate vulnerabilities and POA&M items with technical teams, ensuring milestones are met and closure evidence is documented
• Conduct periodic access reviews, security role audits, and user recertifications within OneStream
• Assess the security impact of system changes, upgrades, and new integrations before deployment
• Support annual assessments, ATO reauthorizations, and ongoing authorization activities
• Partner with OneStream team to design and validate the security model, including security groups, roles, cube and workflow access, and data-level restrictions
• Review integrations with source systems (e.g., Momentum and data warehouses) for secure data transfer and interface controls
• Confirm audit logging and reporting capabilities meet federal record-keeping and accountability requirements
• Support financial statement audits and IT general controls (ITGC) reviews, including FISCAM-based testing, by preparing evidence and responding to auditor requests
• Brief program leadership and government stakeholders on security posture, risks, and remediation status
• Contribute security content to proposals, project plans, and client deliverables as needed

Requirements:

• U.S. citizenship
• Minimum of five (5) years of relevant cybersecurity experience, including at least three (3) years supporting on-premise or SaaS federal information systems
• Demonstrated experience preparing and sustaining ATO packages under the NIST Risk Management Framework
• Working knowledge of NIST SP 800-53, SP 800-37, SP 800-171, and FISMA requirements
• Proven ability to write clear, audit-ready security policies, procedures, and system documentation
• Experience managing POA&Ms and coordinating vulnerability remediation with technical teams
• Active DoD 8140/8570 IAM Level I or IAT Level II baseline certification (e.g., Security+, CASP+, CISSP, or CISM), or the ability to obtain one within 90 days of hire
• Bachelor's degree in cybersecurity, information systems, or a related field; additional years of relevant experience may substitute for a degree
• Strong written and verbal communication skills, including briefing senior government stakeholders
• Active Secret clearance, or the ability to obtain and maintain one; Public Trust eligibility at minimum
• Experience working with OneStream or other EPM and financial systems (e.g., Oracle Hyperion, SAP BPC, or Anaplan)
• Background supporting federal financial management programs
• Experience with cloud services, single sign-on and 3rd party integrations
• Familiarity with FedRAMP, DoD Cloud Computing SRG impact levels, and shared-responsibility models for SaaS and cloud-hosted applications
• Hands-on experience with GRC tools
• Experience supporting financial statement audits, FISCAM, or OMB A-123 internal control reviews
• Advanced certifications such as CISSP, CISM, CAP/CGRC, or CCSP