Senior Risk and Compliance Analyst | FedRamp

NinjaOne; California; Hybrid; USD 125.000 - 160.000; Vollzeit

Benefits dieser Stelle

Medical insurance

Dental insurance

Vision insurance

401(k) plan

Unlimited PTO

Hybrid remote

Growth opportunities

Zusammenfassung

NinjaOne is seeking a Senior Risk and Compliance Analyst (FedRAMP) to lead and sustain our FedRAMP program, including High and Moderate authorization, gap assessments, readiness activities, and continuous monitoring.

You will coordinate audits with 3PAOs and agencies, maintain SSP and related docs, and drive automation to streamline evidence collection and reporting, while advising engineering and sales on FedRAMP posture.

Qualifikationen

• Hands-on FedRAMP authorization experience.
• Strong knowledge of NIST 800-53 Rev 5 and RMF.
• Experience writing System Security Plans and procedures.
• Ability to translate technical input into audit-ready docs.
• Experience with 3PAOs and assessment scoping.
• Familiarity with cloud security across AWS/Azure/GCP.
• A track record of automation in compliance workflows.

Aufgaben

• Lead efforts to obtain and maintain FedRAMP High and Moderate authorization, including gap assessments, readiness activities, and remediation tracking
• Support compliance audits by performing IT control testing, collecting evidence, and maintaining the IT control artifact repository
• Coordinate internal and external audits with stakeholders to ensure timely activities
• Manage relationships with the 3PAO, sponsoring agency, and FedRAMP PMO
• Create and review FedRAMP core documentation (SSP, policies, and attachments) and related materials
• Execute FedRAMP Continuous Monitoring deliverables, including monthly POA&M submissions and remediation
• Own the POA&M program and manage Deviation & Change Requests
• Perform vulnerability and compliance scanning and audit security controls
• Coordinate with engineering to implement and demonstrate controls across requirements
• Provide SME guidance to teams and support customer inquiries on FedRAMP posture
• Monitor FedRAMP policy updates and adapt documentation ahead of dates
• Map control inheritance from cloud providers and manage third-party dependencies
• Improve compliance processes via automation and tooling
• Define scalable workflows for expanding scope
• Other duties as needed

Kenntnisse

FedRAMP authorization

NIST SP 800-53

RMF

3PAO coordination

Policy writing

Audit readiness

Cloud security

Automation tooling

GRC platforms

Vulnerability remediation

Stakeholder comms

Tools

Wiz

Tenable

Qualys

AWS Security Hub

OSCAL

Jobbeschreibung

About the Role

As the Senior Risk and Compliance Analyst (FedRamp) at NinjaOne, you will be our FedRAMP subject matter expert, responsible for building and sustaining our FedRAMP compliance program. You will lead efforts to obtain and maintain FedRAMP High and Moderate authorization, from gap assessments and readiness activities through continuous monitoring. You will use your expertise in compliance, risk, and privacy to drive strategy and execution as the program grows with our expansion into Enterprise markets.

Description

About the Role

As the Senior Risk and Compliance Analyst (FedRamp) at NinjaOne, you will be our FedRAMP subject matter expert, responsible for building and sustaining our FedRAMP compliance program. You will lead efforts to obtain and maintain FedRAMP High and Moderate authorization, from gap assessments and readiness activities through continuous monitoring. You will use your expertise in compliance, risk, and privacy to drive strategy and execution as the program grows with our expansion into Enterprise markets.

Location

We are flexible on remote working from home, if you are located in the USA and reside in one of the following states - CA, CO, CT, FL, GA, IL, KS, MA, MD, ME, NJ, NC, NY, OH, OR, TN, TX, VA, and WA. We have physical offices in Austin, TX and Tampa, FL, if you prefer a hybrid option.

What You’ll Be Doing

• Lead efforts to obtain and maintain FedRAMP High and Moderate authorization, including gap assessments, readiness activities, and remediation tracking
• Support compliance audits, primarily FedRAMP, by performing IT control testing, collecting evidence, and maintaining the IT control artifact and evidence repository
• Coordinate internal and external audits assessments with the appropriate internal and external stakeholders to ensure successful and timely audit activities
• Manage relationships with the 3PAO, sponsoring agency, and FedRAMP PMO, including annual assessment scoping, SAP/SAR review, and response to assessor findings
• Create, maintain, and annually review FedRAMP core documentation (SSP and attachments, policies and procedures, CIS/CRM, Incident Response Plan, Contingency Plan, Configuration Management Plan, Digital Identity Worksheet), along with supporting technical material and operational processes
• Execute FedRAMP Continuous Monitoring deliverables, including monthly POA&M submissions, inventory reconciliation, and vulnerability remediation within required SLAs (30/90/180 days)
• Own the POA&M program and prepare, validate, and track Deviation Requests (risk adjustments, false positives, operational requirements) and Significant Change Requests
• Perform vulnerability and compliance scanning, analyze results, and audit security controls for compliance with cloud requirements and governance models
• Coordinate with internal engineering teams to implement and demonstrate security compliance controls across technical, management, and operational requirements
• Provide SME guidance to technical and non-technical teams, educate internal stakeholders on FedRAMP High requirements, and support customer and prospect inquiries on NinjaOne’s FedRAMP posture
• Track upcoming changes to FedRAMP policy, guidance, and baselines; assess impact to the program; and proactively adapt documentation, controls, and processes ahead of effective dates
• Map and maintain control inheritance from cloud service providers, manage third-party and supply chain compliance dependencies, and manage compliance metrics and program reporting
• Continuously improve compliance processes, identify manual, repetitive, or error-prone activities and implement automation and tooling to streamline evidence collection, control monitoring, and reporting
• Define and refine operational processes and workflows that scale the compliance program as the environment and authorization scope grow
• Other duties as needed

About You

• Hands-on experience taking a cloud service offering through FedRAMP authorization (Moderate or High) and maintaining it through continuous monitoring
• Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37 (RMF), FIPS 199/200, FISMA, and the FedRAMP High baseline
• Experience writing, editing, and managing IT security documentation — System Security Plans and attachments, standard operating procedures, policies and procedures, and control implementation narratives
• Experience interviewing subject matter experts and translating technical input into clear, audit-ready documentation
• Experience working directly with Third-Party Assessment Organizations (3PAOs), including assessment scoping, evidence walkthroughs, and remediation of assessor findings
• Experience with POA&M management, deviation requests, and vulnerability remediation against defined SLAs
• Strong knowledge of cloud architecture and security concepts (AWS, Azure, or GCP), including shared responsibility and control inheritance models
• Deep hands‑on knowledge of cloud security and compliance tooling, Wiz, Tenable, Qualys, AWS Security Hub, or similar, including how findings are generated, how severity and scoring are derived, and how to validate, triage, and contextualize results rather than accept them at face value
• Ability to configure, query, and report out of scanning and GRC platforms, including building queries, dashboards, and evidence exports that stand up to assessor scrutiny
• Experience applying AI and automation to compliance work, accelerating evidence collection, documentation drafting, control mapping, finding triage, and POA&M analysis, with sound judgment about where automated output requires human validation
• Experience designing and implementing automation for recurring compliance activities, including evidence collection, control monitoring, scan triage, and reporting
• Track record of identifying process gaps and driving measurable improvements, reducing manual effort, shortening audit cycles, and improving evidence quality and consistency
• Ability to manage competing priorities across multiple audit cycles and communicate effectively with technical teams, executives, auditors, and federal stakeholders

Nice to Have

• Experience with StateRAMP, CMMC, DoD Impact Levels (IL4/IL5), ISO 27001, or SOC 2
• Relevant certifications (CISSP, CISA, CCSP, CGRC/CAP)
• Experience with scripting or query languages (Python, SQL, KQL, Rego) for automating evidence collection and compliance reporting
• Familiarity with OSCAL and machine-readable compliance documentation
• Experience supporting sales or customer-facing teams on security questionnaires and compliance inquiries
• Experience producing technical diagrams and data flow / authorization boundary drawings using MS Visio, Lucidchart, or similar

About Us

NinjaOne unifies IT to simplify work for nearly 40,000 customers in 140+ countries. The NinjaOne Unified IT Operations Platform delivers endpoint management, autonomous patching, backup, and remote access in a single console to improve efficiency, increase resilience, and reduce spend. By automating IT and managing all endpoints, organizations give employees a great technology experience at work. NinjaOne is obsessed with customer success and has retained a 98% customer satisfaction score for more than 5 years.

What You’ll Love

• We are a collaborative, kind, and curious community.
• We honor your flexibility needs with full‑time work that is hybrid remote.
• We have you covered with our comprehensive benefits package, which includes medical, dental, and vision insurance.
• We help you prepare for your financial future with our 401(k) plan.
• We prioritize your work‑life balance with our unlimited PTO.
• We reward your work with opportunity for growth and advancement.

Additional Information

This position is NOT eligible for Visa sponsorship. Due to federal government security requirements associated with our FedRAMP‑authorized environment, candidates must be U.S. citizens or lawful permanent residents.

• Due to operational policies, NinjaOne is unable to hire for this role within the city limits of Chicago. We will consider all qualified candidates who reside outside of the city proper or are willing to self‑relocate.

Starting pay for the successful applicant depends on a variety of job‑related factors, including but not limited to location, market demands, experience, job‑related knowledge, and skills. The benefits available for this position include medical, dental, vision, 401(k) plan, life insurance coverage and PTO. For roles based in California, Colorado, Maryland, New Jersey, or Washington the base salary hiring range for this position is $125,000 to $160,000 per year.

For roles based in New York, the base salary hiring range for this position is $125,000 to $160,000 per year.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, marital status, veteran status, or any other status protected by applicable law. We are committed to providing an inclusive and diverse work environment.