FedRAMP Compliance Manager — Remote

Figma; San Francisco, Northern (CA, KY); Hybrid; USD 153,000 - 245,000; Full time

Benefits offered by this job

Equity

Health, dental, vision

Retirement plan

Parental leave

Mental health benefits

PTO & flexible PTO

Sick leave & holidays

Cell phone & home internet reimburse.

Lifestyle spending accounts

Bonus plan

Job summary

Figma is seeking a Federal Compliance Manager to lead FedRAMP governance, audits, and control implementation across legal, product, and engineering teams. You will help document, remediate, and report on security controls, ensuring FedRAMP readiness and ongoing compliance.

The role entails collaboration with cloud providers, sponsors, and regulatory bodies, with emphasis on security posture and program risk management. Remote work within the United States is supported.

Qualifications

• 5+ years of hands-on experience in IT auditing and/or compliance.
• Recent hands-on concentration of work with FedRAMP Framework.
• Previous experience leading a Cloud Service Provider through a FedRAMP ATO process.
• SaaS-based audit and compliance experience.
• Experience working with technologies hosted via cloud computing environments (e.g., AWS).

Responsibilities

• Collaborate with legal, product and engineering teams to implement FedRAMP controls.
• Support audits, vulnerability remediation and plan of action & milestones (POAM).
• Maintain SSP and security documentation with emphasis on controls and architecture.
• Escalate technical and program risks to stakeholders and track resolution.
• Guide teams on FedRAMP implementation and its impact on roadmaps.

Skills

IT auditing

Compliance

FedRAMP expertise

SaaS compliance

AWS

Job description

Figma is seeking a Federal Compliance Manager to lead FedRAMP governance, audits, and control implementation across legal, product, and engineering teams. You will help document, remediate, and report on security controls, ensuring FedRAMP readiness and ongoing compliance.

The role entails collaboration with cloud providers, sponsors, and regulatory bodies, with emphasis on security posture and program risk management. Remote work within the United States is supported.