Senior Risk and Compliance Analyst | FedRamp

As the Senior Risk and Compliance Analyst (Fed Ramp) at Ninja One, you will be our FedRAMP subject matter expert, responsible for building and sustaining our FedRAMP compliance program. You will lead efforts to obtain and maintain FedRAMP High and Moderate authorization, from gap assessments and readiness activities through continuous monitoring. You will use your expertise in compliance, risk, and privacy to drive strategy and execution as the program grows with our expansion into Enterprise markets.

As the Senior Risk and Compliance Analyst (Fed Ramp) at Ninja One, you will be our FedRAMP subject matter expert, responsible for building and sustaining our FedRAMP compliance program. You will lead efforts to obtain and maintain FedRAMP High and Moderate authorization, from gap assessments and readiness activities through continuous monitoring. You will use your expertise in compliance, risk, and privacy to drive strategy and execution as the program grows with our expansion into Enterprise markets.

We are flexible on remote working from home, if you are located in the USA and reside in one of the following states - CA, CO, CT, FL, GA, IL, KS, MA, MD, ME, NJ, NC, NY, OH, OR, TN, TX, VA, and WA. We have physical offices in Austin, TX and Tampa, FL, if you prefer a hybrid option.

• Lead efforts to obtain and maintain FedRAMP High and Moderate authorization, including gap assessments, readiness activities, and remediation tracking
• Support compliance audits, primarily FedRAMP, by performing IT control testing, collecting evidence, and maintaining the IT control artifact and evidence repository
• Coordinate internal and external audits assessments with the appropriate internal and external stakeholders to ensure successful and timely audit activities
• Manage relationships with the 3
  
  PAO, sponsoring agency, and FedRAMP PMO, including annual assessment scoping, SAP/SAR review, and response to assessor findings
• Create, maintain, and annually review FedRAMP core documentation (SSP and attachments, policies and procedures, CIS/CRM, Incident Response Plan, Contingency Plan, Configuration Management Plan, Digital Identity Worksheet), along with supporting technical material and operational processes
• Execute FedRAMP Continuous Monitoring deliverables, including monthly POA&M submissions, inventory reconciliation, and vulnerability remediation within required SLAs (30/90/180 days)
• Own the POA&M program and prepare, validate, and track Deviation Requests (risk adjustments, false positives, operational requirements) and Significant Change Requests
• Perform vulnerability and compliance scanning, analyze results, and audit security controls for compliance with cloud requirements and governance models
• Coordinate with internal engineering teams to implement and demonstrate security compliance controls across technical, management, and operational requirements
• Provide SME guidance to technical and non-technical teams, educate internal stakeholders on FedRAMP High requirements, and support customer and prospect inquiries on Ninja One’s FedRAMP posture
• Track upcoming changes to FedRAMP policy, guidance, and baselines; assess impact to the program; and proactively adapt documentation, controls, and processes ahead of effective dates
• Map and maintain control inheritance from cloud service providers, manage third-party and supply chain compliance dependencies, and manage compliance metrics and program reporting
• Continuously improve compliance processes, identify manual, repetitive, or error-prone activities and implement automation and tooling to streamline evidence collection, control monitoring, and reporting
• Define and refine operational processes and workflows that scale the compliance program as the environment and authorization scope grow
• Other duties as needed

• Hands-on experience taking a cloud service offering through FedRAMP authorization (Moderate or High) and maintaining it through continuous monitoring
• Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-37 (RMF), FIPS 199/200, FISMA, and the FedRAMP High baseline
• Experience writing, editing, and managing IT security documentation — System Security Plans and attachments, standard operating procedures, policies and procedures, and control implementation narratives
• Experience interviewing subject matter experts and translating technical input into clear, audit-ready documentation
• Experience working directly with Third-Party…