Senior Risk and Compliance Analyst | FedRamp

As the Senior Risk and Compliance Analyst (FedRamp) at NinjaOne, you will be our FedRAMP subject matter expert, responsible for building and sustaining our FedRAMP compliance program. You will lead efforts to obtain and maintain FedRAMP High and Moderate authorization, from gap assessments and readiness activities through continuous monitoring. You will use your expertise in compliance, risk, and privacy to drive strategy and execution as the program grows with our expansion into Enterprise markets. 

• →

  Lead efforts to obtain and maintain FedRAMP High and Moderate authorization, including gap assessments, readiness activities, and remediation tracking 

• →

  Support compliance audits, primarily FedRAMP, by performing IT control testing, collecting evidence, and maintaining the IT control artifact and evidence repository 

• →

  Coordinate internal and external audits assessments with the appropriate internal and external stakeholders to ensure successful and timely audit activities 

• →

  Manage relationships with the 3PAO, sponsoring agency, and FedRAMP PMO, including annual assessment scoping, SAP/SAR review, and response to assessor findings 

• →

  Create, maintain, and annually review FedRAMP core documentation (SSP and attachments, policies and procedures, CIS/CRM, Incident Response Plan, Contingency Plan, Configuration Management Plan, Digital Identity Worksheet), along with supporting technical material and operational processes 

• →

  Execute FedRAMP Continuous Monitoring deliverables, including monthly POA&M submissions, inventory reconciliation, and vulnerability remediation within required SLAs (30/90/180 days) 

• →

  Own the POA&M program and prepare, validate, and track Deviation Requests (risk adjustments, false positives, operational requirements) and Significant Change Requests 

• →

  Perform vulnerability and compliance scanning, analyze results, and audit security controls for compliance with cloud requirements and governance models 

• →

  Coordinate with internal engineering teams to implement and demonstrate security compliance controls across technical, management, and operational requirements 

• →

  Provide SME guidance to technical and non-technical teams, educate internal stakeholders on FedRAMP High requirements, and support customer and prospect inquiries on NinjaOne’s FedRAMP posture 

• →

  Track upcoming changes to FedRAMP policy, guidance, and baselines; assess impact to the program; and proactively adapt documentation, controls, and processes ahead of effective dates 

• →

  Map and maintain control inheritance from cloud service providers, manage third-party and supply chain compliance dependencies, and manage compliance metrics and program reporting 

• →

  Continuously improve compliance processes, identify manual, repetitive, or error-prone activities and implement automation and tooling to streamline evidence collection, control monitoring, and reporting 

• →

  Define and refine operational processes and workflows that scale the compliance program as the environment and authorization scope grow 

• →

  Other duties as needed 

• Hands-on experience taking a cloud service offering through FedRAMP authorization (Moderate or High) and maintaining it through continuous monitoring 

• Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37 (RMF), FIPS 199/200, FISMA, and the FedRAMP High baseline 

• Experience writing, editing, and managing IT security documentation — System Security Plans and attachments, standard operating procedures, policies and procedures, and control implementation narratives 

• Experience interviewing subject matter experts and translating technical input into clear, audit-ready documentation 

• Experience working directly with Third-Party Assessment Organizations (3PAOs), including assessment scoping, evidence walkthroughs, and remediation of assessor findings 

• Experience with POA&M management, deviation requests, and vulnerability remediation against defined SLAs 

• Strong knowledge of cloud architecture and security concepts (AWS, Azure, or GCP), including shared responsibility and control inheritance models 

• Deep hands-on knowledge of cloud security and compliance tooling, Wiz, Tenable, Qualys, AWS Security Hub, or similar, including how findings are generated, how severity and scoring are derived, and how to validate, triage, and contextualize results rather than accept them at face value 

• Ability to configure, query, and report out of scanning and GRC platforms, including building queries, dashboards, and evidence exports that stand up to assessor scrutiny 

• Experience applying AI and automation to compliance work, accelerating evidence collection, documentation drafting, control mapping, finding triage, and POA&M analysis, with sound judgment about where automated output requires human validation 

• Experience designing and implementing automation for recurring compliance activities, including evidence collection, control monitoring, scan triage, and reporting 

• Track record of identifying process gaps and driving measurable improvements, reducing manual effort, shortening audit cycles, and improving evidence quality and consistency 

• Ability to manage competing priorities across multiple audit cycles and communicate effectively with technical teams, executives, auditors, and federal stakeholders 

• Experience with StateRAMP, CMMC, DoD Impact Levels (IL4/IL5), ISO 27001, or SOC 2 

• Relevant certifications (CISSP, CISA, CCSP, CGRC/CAP) 

• Experience with scripting or query languages (Python, SQL, KQL, Rego) for automating evidence collection and compliance reporting 

• Familiarity with OSCAL and machine-readable compliance documentation 

• Experience supporting sales or customer-facing teams on security questionnaires and compliance inquiries 

• Experience producing technical diagrams and data flow / authorization boundary drawings using MS Visio, Lucidchart, or similar 

NinjaOne unifies IT to simplify work for nearly 40,000 customers in 140+ countries.The NinjaOne Unified IT Operations Platform delivers endpoint management, autonomous patching, backup, and remote access in a single console to improve efficiency, increase resilience, and reduce spend. By automating IT and managing all endpoints, organizations give employees a great technology experience at work. NinjaOne is obsessed with customer success and has retained a 98% customer satisfaction score for more than 5 years. 

• We are a collaborative, kind, and curious community. 

• We honor your flexibility needs with full-time work that is hybrid remote. 

• We have you covered with our comprehensive benefits package, which includes medical, dental, and vision insurance. 

• We help you prepare for your financial future with our 401(k) plan. 

• We prioritize your work-life balance with our unlimited PTO. 

• We reward your work with opportunity for growth and advancement. 

Additional Information 

This position is NOT eligible for Visa sponsorship. Due to federal government security requirements associated with our FedRAMP-authorized environment, candidates must be U.S. citizens or lawful permanent residents. 

*Due to operational policies, NinjaOne is unable to hire for this role within the city limits of Chicago. We will consider all qualified candidates who reside outside of the city proper or are willing to self-relocate. 

Starting pay for the successful applicant depends on a variety of job-related factors, including but not limited to location, market demands, experience, job-related knowledge, and skills. The benefits available for this position include medical, dental, vision, 401(k) plan, life insurance coverage and PTO. For roles based in California, Colorado, Maryland, New Jersey, or Washington the base salary hiring range for this position is $125,000 to $160,000 per year. 

For roles based in New York, the base salary hiring range for this position is $125,000 to $160,000 per year. 

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, marital status, veteran status, or any other status protected by applicable law. We are committed to providing an inclusive and diverse work environment.