As the Senior Risk and Compliance Analyst (FedRamp) at NinjaOne, you will be our FedRAMP subject matter expert, responsible for building and sustaining our FedRAMP compliance program. You will lead efforts to obtain and maintain FedRAMP High and Moderate authorization, from gap assessments and readiness activities through continuous monitoring. You will use your expertise in compliance, risk, and privacy to drive strategy and execution as the program grows with our expansion into Enterprise markets.
Location - We are flexible on remote working from home, if you are located in the USA and reside in one of the following states - CA, CO, CT, FL, GA, *IL, KS, MA, MD, ME, NJ, NC, NY, OH, OR, TN, TX, VA,and WA. We have physical offices in Austin, TX and Tampa, FL, if you prefer a hybrid option.
Lead efforts to obtain and maintain FedRAMP High and Moderate authorization, including gap assessments, readiness activities, and remediation tracking
Support compliance audits, primarily FedRAMP, by performing IT control testing, collecting evidence, and maintaining the IT control artifact and evidence repository
Manage relationships with the 3PAO, sponsoring agency, and FedRAMP PMO, including annual assessment scoping, SAP/SAR review, and response to assessor findings
Create, maintain, and annually review FedRAMP core documentation (SSP and attachments, policies and procedures, CIS/CRM, Incident Response Plan, Contingency Plan, Configuration Management Plan, Digital Identity Worksheet), along with supporting technical material and operational processes
Execute FedRAMP Continuous Monitoring deliverables, including monthly POA&M submissions, inventory reconciliation, and vulnerability remediation within required SLAs (30/90/180 days)
Own the POA&M program and prepare, validate, and track Deviation Requests (risk adjustments, false positives, operational requirements) and Significant Change Requests
Track upcoming changes to FedRAMP policy, guidance, and baselines; assess impact to the program; and proactively adapt documentation, controls, and processes ahead of effective dates
Continuously improve compliance processes, identify manual, repetitive, or error-prone activities and implement automation and tooling to streamline evidence collection, control monitoring, and reporting
Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37 (RMF), FIPS 199/200, FISMA, and the FedRAMP High baseline
Experience writing, editing, and managing IT security documentation — System Security Plans and attachments, standard operating procedures, policies and procedures, and control implementation narratives
Experience working directly with Third-Party Assessment Organizations (3PAOs), including assessment scoping, evidence walkthroughs, and remediation of assessor findings
Strong knowledge of cloud architecture and security concepts (AWS, Azure, or GCP), including shared responsibility and control inheritance models
Deep hands-on knowledge of cloud security and compliance tooling, Wiz, Tenable, Qualys, AWS Security Hub, or similar, including how findings are generated, how severity and scoring are derived, and how to validate, triage, and contextualize results rather than accept them at face value
Ability to configure, query, and report out of scanning and GRC platforms, including building queries, dashboards, and evidence exports that stand up to assessor scrutiny
Experience applying AI and automation to compliance work, accelerating evidence collection, documentation drafting, control mapping, finding triage, and POA&M analysis, with sound judgment about where automated output requires human validation
Experience designing and implementing automation for recurring compliance activities, including evidence collection, control monitoring, scan triage, and reporting
Track record of identifying process gaps and driving measurable improvements, reducing manual effort, shortening audit cycles, and improving evidence quality and consistency
Ability to manage competing priorities across multiple audit cycles and communicate effectively with technical teams, executives, auditors, and federal stakeholders
Experience with StateRAMP, CMMC, DoD Impact Levels (IL4/IL5), ISO 27001, or SOC 2
Experience with scripting or query languages (Python, SQL, KQL, Rego) for automating evidence collection and compliance reporting
NinjaOne unifies IT to simplify work for nearly 40,000 customers in 140+ countries.TheNinjaOne Unified IT Operations Platform delivers endpoint management, autonomous patching, backup, and remote access in a single console to improve efficiency, increase resilience, and reduce spend. By automating IT and managing all endpoints, organizations give employees a great technology experience at work. NinjaOne is obsessed with customer success and has retained a 98% customer satisfaction score for more than 5 years.
We have you covered with our comprehensive benefits package, which includes medical, dental, and vision insurance.
This position is NOT eligible for Visa sponsorship. Due to federal government security requirements associated with our FedRAMP-authorized environment, candidates must be U.S. citizens or lawful permanent residents.
*Due to operational policies, NinjaOne is unable to hire for this role within the city limits of Chicago. We will consider all qualified candidates who reside outside of the city proper or are willing to self-relocate.
Starting pay for the successful applicant depends on a variety of job-related factors, including but not limited to location, market demands, experience, job-related knowledge, and skills. The benefits available for this position include medical, dental, vision, 401(k) plan, life insurance coverage and PTO. For roles based in California, Colorado, Maryland, New Jersey, or Washington the base salary hiring range for this position is $125,000 to $160,000 per year.
For roles based in New York, the base salary hiring range for this position is $125,000 to $160,000 per year.
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, marital status, veteran status, or any other status protected by applicable law. We are committed to providing an inclusive and diverse work environment.
