Senior Risk and Compliance Analyst | FedRamp

NinjaOne

1d•$125,000 - $160,000•Hybrid

About The Position

As the Senior Risk and Compliance Analyst (FedRAMP) at NinjaOne, you will serve as the company’s FedRAMP subject matter expert and build and sustain its FedRAMP compliance program. You will lead efforts to obtain and maintain FedRAMP High and Moderate authorization, from gap assessments and readiness activities through continuous monitoring, using your compliance, risk, and privacy expertise to guide strategy and execution as the program grows with NinjaOne’s expansion into Enterprise markets. The role may be remote for candidates residing in eligible U.S. states: CA, CO, CT, FL, GA, IL, KS, MA, MD, ME, NJ, NC, NY, OH, OR, TN, TX, VA, and WA. Hybrid work is available at the company’s offices in Austin, Texas, and Tampa, Florida. NinjaOne describes its work environment as collaborative, kind, and curious, and offers flexibility through full-time hybrid-remote work. Candidates must be U.S. citizens or lawful permanent residents, and the position is not eligible for visa sponsorship. NinjaOne cannot hire for this role within Chicago city limits, but will consider qualified candidates who live outside the city proper or are willing to relocate themselves. The starting salary depends on job-related factors such as location, market demands, experience, knowledge, and skills. The stated base salary range is $125,000–$160,000 per year for roles based in California, Colorado, Maryland, New Jersey, Washington, and New York.

Requirements

Hands-on experience taking a cloud service offering through FedRAMP Moderate or High authorization and maintaining it through continuous monitoring.
Working knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-37 (RMF), FIPS 199/200, FISMA, and the FedRAMP High baseline.
Experience writing, editing, and managing IT security documentation, including System Security Plans and attachments, standard operating procedures, policies and procedures, and control implementation narratives.
Experience interviewing subject matter experts and translating technical input into clear, audit-ready documentation.
Experience working directly with 3PAOs, including assessment scoping, evidence walkthroughs, and remediation of assessor findings.
Experience managing POA&Ms and deviation requests, and remediating vulnerabilities against defined SLAs.
Strong knowledge of cloud architecture and security concepts for AWS, Azure, or GCP, including shared responsibility and control inheritance models.
Deep hands-on knowledge of cloud security and compliance tooling such as Wiz, Tenable, Qualys, AWS Security Hub, or similar; understanding how findings are generated and scored, and how to validate, triage, and contextualize results.
Ability to configure, query, and report from scanning and GRC platforms, including building queries, dashboards, and evidence exports that withstand assessor scrutiny.
Experience applying AI and automation to compliance work, including evidence collection, documentation drafting, control mapping, finding triage, and POA&M analysis, with sound judgment about where automated output requires human validation.
Experience designing and implementing automation for recurring compliance activities, including evidence collection, control monitoring, scan triage, and reporting.
Track record of identifying process gaps and driving measurable improvements that reduce manual effort, shorten audit cycles, and improve evidence quality and consistency.
Ability to manage competing priorities across multiple audit cycles and communicate effectively with technical teams, executives, auditors, and federal stakeholders.
Must be a U.S. citizen or lawful permanent resident; the role is not eligible for visa sponsorship.

Nice To Haves

Experience with StateRAMP, CMMC, DoD Impact Levels (IL4/IL5), ISO 27001, or SOC 2.
Relevant certifications such as CISSP, CISA, CCSP, or CGRC/CAP.
Experience with scripting or query languages such as Python, SQL, KQL, or Rego for automating evidence collection and compliance reporting.
Familiarity with OSCAL and machine-readable compliance documentation.
Experience supporting sales or customer-facing teams with security questionnaires and compliance inquiries.
Experience producing technical diagrams and data-flow or authorization-boundary drawings using MS Visio, Lucidchart, or similar tools.

Responsibilities

Lead efforts to obtain and maintain FedRAMP High and Moderate authorization, including gap assessments, readiness activities, and remediation tracking.
Support compliance audits, primarily FedRAMP, by testing IT controls, collecting evidence, and maintaining the IT control artifact and evidence repository.
Coordinate internal and external audits and assessments with relevant stakeholders to support successful, timely audit activities.
Manage relationships with the 3PAO, sponsoring agency, and FedRAMP PMO, including annual assessment scoping, SAP/SAR review, and responses to assessor findings.
Create, maintain, and annually review FedRAMP core documentation and supporting materials, including the SSP and attachments, policies and procedures, CIS/CRM, Incident Response Plan, Contingency Plan, Configuration Management Plan, and Digital Identity Worksheet.
Execute FedRAMP continuous-monitoring deliverables, including monthly POA&M submissions, inventory reconciliation, and vulnerability remediation within required 30-, 90-, and 180-day SLAs.
Own the POA&M program; prepare, validate, and track Deviation Requests and Significant Change Requests.
Perform vulnerability and compliance scanning, analyze results, and audit security controls against cloud requirements and governance models.
Coordinate with internal engineering teams to implement and demonstrate security compliance controls across technical, management, and operational requirements.
Provide subject-matter expertise to technical and non-technical teams, educate stakeholders on FedRAMP High requirements, and support customer and prospect inquiries about NinjaOne’s FedRAMP posture.
Track changes to FedRAMP policy, guidance, and baselines; assess their impact and proactively adapt documentation, controls, and processes.
Map and maintain control inheritance from cloud service providers; manage third-party and supply-chain compliance dependencies; and manage compliance metrics and program reporting.
Improve compliance processes by identifying manual, repetitive, or error-prone activities and implementing automation and tooling for evidence collection, control monitoring, and reporting.
Define and refine operational processes and workflows to scale the compliance program as the environment and authorization scope grow.
Perform other duties as needed.