Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 7 days ago

Cyber Security Analyst

Andrew Morgan14 open roles

Pay
$140,000 – $155,000 a year
Where
US - Remote
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowCyber Security AnalystAndrew Morgan · US - Remote

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Andrew Morgan's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. Andrew Morgan postings stay open a median of 27 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.7%14 days
  5. 35.6%30 days
  6. 58.0%60 days
This job: posted 7 days ago

Andrew Morgan median: 27 days open

The posting

Andrew Morgan LLC (AM) is a fast-growing Service-Disabled Veteran-Owned Small Business (SDVOSB). We are currently seeking a qualified Cyber Security Analyst (Federal OneStream Support) to join our team supporting our DoD Federal Client. The analyst will own the security compliance lifecycle for the platform, from authoring policies and procedures through achieving and sustaining the Authority to Operate (ATO).

Working alongside functional, technical, and program teams, the analyst will translate federal security requirements into practical controls for a cloud-based enterprise performance management (EPM) solution. This role suits a hands-on practitioner who is equally comfortable writing a System Security Plan, briefing an Authorizing Official, and reviewing OneStream security roles with administrators.

RESPONSIBILITIES:

  • Lead the full RMF lifecycle (NIST SP 800-37) for OneStream systems: categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
  • Develop and maintain the ATO package, including the System Security Plan (SSP), Security Assessment Report inputs, Plan of Action and Milestones (POA&M), contingency plan, incident response plan, and configuration management plan.
  • Map and document NIST SP 800-53 controls, including inherited controls from FedRAMP-authorized cloud service providers and customer-responsibility controls.
  • Coordinate with Security Control Assessors (SCAs), Information System Security Managers (ISSMs), and Authorizing Officials (AOs) to drive packages to authorization.
  • Manage artifacts and workflows the GRC tool.
  • Author, review, and update system-specific security policies, standard operating procedures (SOPs), and rules of behavior.
  • Document access control, account management, audit logging, separation of duties, and data handling procedures tailored to OneStream.
  • Align documentation with applicable federal and agency guidance, including DoD Instruction 8510.01, DISA STIGs and SRGs, FISMA, and OMB Circulars A-130 and A-123.
  • Track and remediate vulnerabilities and POA&M items with technical teams, ensuring milestones are met and closure evidence is documented.
  • Conduct periodic access reviews, security role audits, and user recertifications within OneStream.
  • Assess the security impact of system changes, upgrades, and new integrations before deployment.
  • Support annual assessments, ATO reauthorizations, and ongoing authorization activities.
  • Partner with OneStream team to design and validate the security model, including security groups, roles, cube and workflow access, and data-level restrictions.
  • Review integrations with source systems (e.g., Momentum and data warehouses) for secure data transfer and interface controls.
  • Confirm audit logging and reporting capabilities meet federal record-keeping and accountability requirements.
  • Support financial statement audits and IT general controls (ITGC) reviews, including FISCAM-based testing, by preparing evidence and responding to auditor requests.
  • Brief program leadership and government stakeholders on security posture, risks, and remediation status.
  • Contribute security content to proposals, project plans, and client deliverables as needed.

REQUIREMENTS:

  • U.S. citizenship.
  • Minimum of five (5) years of relevant cybersecurity experience, including at least three (3) years supporting on-premise or SaaS federal information systems.
  • Demonstrated experience preparing and sustaining ATO packages under the NIST Risk Management Framework.
  • Working knowledge of NIST SP 800-53, SP 800-37, SP 800-171, and FISMA requirements.
  • Proven ability to write clear, audit-ready security policies, procedures, and system documentation.
  • Experience managing POA&Ms and coordinating vulnerability remediation with technical teams.
  • Active DoD 8140/8570 IAM Level I or IAT Level II baseline certification (e.g., Security+, CASP+, CISSP, or CISM), or the ability to obtain one within 90 days of hire.
  • Bachelor's degree in cybersecurity, information systems, or a related field; additional years of relevant experience may substitute for a degree.
  • Strong written and verbal communication skills, including briefing senior government stakeholders.

PREFERRED QUALIFICATIONS:

  • Active Secret clearance, or the ability to obtain and maintain one; Public Trust eligibility at minimum.
  • Experience working with OneStream or other EPM and financial systems (e.g., Oracle Hyperion, SAP BPC, or Anaplan).
  • Background supporting federal financial management programs.
  • Experience with cloud services, single sign-on and 3rd party integrations
  • Familiarity with FedRAMP, DoD Cloud Computing SRG impact levels, and shared-responsibility models for SaaS and cloud-hosted applications.
  • Hands-on experience with GRC tools.
  • Experience supporting financial statement audits, FISCAM, or OMB A-123 internal control reviews.
  • Advanced certifications such as CISSP, CISM, CAP/CGRC, or CCSP.

SALARY:

Base Salary: $140,000-$155,000

Salary is commensurate with both location and experience.

THE AM EMPLOYEE WILL DISPLAY…

  • Attention to Detail: Produce high-quality deliverables and outputs that align with contract outcomes.
  • Self-Sufficiency: Execute tasks independently, seeking client assistance only after internal resources are exhausted, ensuring requests align with contract goals.
  • Teamwork: Collaborate effectively with team members, including AMC resources, subcontractors, and government stakeholders.
  • Communication/Engagement: Maintain professional conduct in meetings and written communication, participating actively with cameras on.
  • Responsiveness: Stay engaged, communicate promptly, and ensure deadlines are consistently met.

ABOUT ANDREW MORGAN…

Andrew Morgan LLC, founded in 2017 and headquartered in Alexandria, VA, is a Service-Disabled Veteran Owned Small Business (SDVOSB). We specialize in delivering high-quality consulting services to both federal and commercial clients, offering expertise in Strategy and Management Consulting, Technology & Architecture Services, and Industry & Mission Analytics Solutions. Our distinguished clientele includes the Department of Veterans Affairs (VA), National Aeronautics and Space Administration (NASA), the Department of Defense (DoD), and the United Stated Army Corps of Engineers (USACE). We are committed to providing innovative solutions and exceptional service to support our clients' missions and objectives.

BENEFITS:

  • 15 days of Paid Time Off + 11 Paid Federal Holidays
  • 401K Program (up to 4% employer matching)
  • Three Gold Healthcare Options (with 75%-90% employer-paid premiums)
  • Flexible Spending Account / Dependent Care Assistance Program
  • Employer-Paid Short Term Disability Insurance
  • Employer-Paid Long Term Disability Insurance
  • Employer-Paid Life Insurance
  • Professional Training and Development
  • Corporate Team Building Events
  • And MORE!

EQUAL OPPORTUNITY EMPLOYER:

Andrew Morgan does not discriminate in employment opportunities, terms and conditions of employment, or practices. All qualified applicants will receive consideration for employment without regard to race, age, gender, religious or political beliefs, national origin or heritage, disability, sexual orientation, protected veteran status, or any characteristic protected by law. ​

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Andrew Morgan's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Andrew Morgan's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Andrew Morgan's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.