Senior Risk and Compliance Analyst | FedRamp

About the Role
As the Senior Risk and Compliance Analyst (FedRamp) at NinjaOne, you will be our FedRAMP subject matter expert, responsible for building and sustaining our FedRAMP compliance program. You will lead efforts to obtain and maintain FedRAMP High and Moderate authorization, from gap assessments and readiness activities through continuous monitoring. You will use your expertise in compliance, risk, and privacy to drive strategy and execution as the program grows with our expansion into Enterprise markets.
Location - We are flexible on remote working from home, if you are located in the USA and reside in one of the following states - CA, CO, CT, FL, GA, *IL, KS, MA, MD, ME, NJ, NC, NY, OH, OR, TN, TX, VA, and WA. We have physical offices in Austin, TX and Tampa, FL, if you prefer a hybrid option.
What You’ll be Doing
Lead efforts to obtain and maintain FedRAMP High and Moderate authorization, including gap assessments, readiness activities, and remediation tracking
Support compliance audits, primarily FedRAMP, by performing IT control testing, collecting evidence, and maintaining the IT control artifact and evidence repository
Coordinate internal and external audits assessments with the appropriate internal and external stakeholders to ensure successful and timely audit activities
Manage relationships with the 3PAO, sponsoring agency, and FedRAMP PMO, including annual assessment scoping, SAP/SAR review, and response to assessor findings
Create, maintain, and annually review FedRAMP core documentation (SSP and attachments, policies and procedures, CIS/CRM, Incident Response Plan, Contingency Plan, Configuration Management Plan, Digital Identity Worksheet), along with supporting technical material and operational processes
Execute FedRAMP Continuous Monitoring deliverables, including monthly POA&M submissions, inventory reconciliation, and vulnerability remediation within required SLAs (30/90/180 days)
Own the POA&M program and prepare, validate, and track Deviation Requests (risk adjustments, false positives, operational requirements) and Significant Change Requests
Perform vulnerability and compliance scanning, analyze results, and audit security controls for compliance with cloud requirements and governance models
Coordinate with internal engineering teams to implement and demonstrate security compliance controls across technical, management, and operational requirements
Provide SME guidance to technical and non-technical teams, educate internal stakeholders on FedRAMP High requirements, and support customer and prospect inquiries on NinjaOne’s FedRAMP posture
Track upcoming changes to FedRAMP policy, guidance, and baselines; assess impact to the program; and proactively adapt documentation, controls, and processes ahead of effective dates
Map and maintain control inheritance from cloud service providers, manage third-party and supply chain compliance dependencies, and manage compliance metrics and program reporting
Continuously improve compliance processes, identify manual, repetitive, or error-prone activities and implement automation and tooling to streamline evidence collection, control monitoring, and reporting
Define and refine operational processes and workflows that scale the compliance program as the environment and authorization scope grow
Other duties as needed
About You
Hands-on experience taking a cloud service offering through FedRAMP authorization (Moderate or High) and maintaining it through continuous monitoring
Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37 (RMF), FIPS 199/200, FISMA, and the FedRAMP High baseline
Experience writing, editing, and managing IT security documentation — System Security Plans and attachments, standard operating procedures, policies and procedures, and control implementation narratives
Experience interviewing subject matter experts and translating technical input into clear, audit-ready documentation
Experience working directly with Third-Party Assessment Organizations (3PAOs), including assessment scoping, evidence walkthroughs, and remediation of assessor findings
Experience with POA&M management, deviation requests, and vulnerability remediation against defined SLAs
Strong knowledge of cloud architecture and security concepts (AWS, Azure, or GCP), including shared responsibility and control inheritance models
Deep hands-on knowledge of cloud security and compliance tooling, Wiz, Tenable, Qualys, AWS Security Hub, or similar, including how findings are generated, how severity and scoring are derived, and how to validate, triage, and contextualize results rather than accept them at face value
Ability to configure, query, and report out of scanning and GRC platforms, including building queries, dashboards, and evidence exports that stand up to assessor scrutiny
Experience applying AI and automation to compliance work, accelerating evidence collection, documentation drafting, control mapping, finding triage, and POA&M analysis, with sound judgment about where automated output requires human validation
Experience designing and implementing automation for recurring compliance activities, including evidence collection, control monitoring, scan triage, and reporting
Track record of identifying process gaps and driving measurable improvements, reducing manual effort, shortening audit cycles, and improving evidence quality and consistency
Ability to manage competing priorities across multiple audit cycles and communicate effectively with technical teams, executives, auditors, and federal stakeholders
Nice to Have
Experience with StateRAMP, CMMC, DoD Impact Levels (IL4/IL5), ISO 27001, or SOC 2
Relevant certifications (CISSP, CISA, CCSP, CGRC/CAP)
Experience with scripting or query languages (Python, SQL, KQL, Rego) for automating evidence collection and compliance reporting
Familiarity with OSCAL and machine-readable compliance documentation
Experience supporting sales or customer-facing teams on security questionnaires and compliance inquiries
Experience producing technical diagrams and data flow / authorization boundary drawings using MS Visio, Lucidchart, or similar
About Us
NinjaOne unifies IT to simplify work for nearly 40,000 customers in 140+ countries.