Enterprise Technology Risk - Risk Management - Senior Director

The Fannie Mae; Reston (VA); On-site; USD 200,000 - 269,000; Full time

Job summary

The Fannie Mae is seeking a Senior Director of Cybersecurity Risk Oversight to lead the 2LOD function, oversee governance and risk appetite, and provide independent challenge to cyber risk programs. You will translate complex risks into executive insight and oversee risk metrics, incidents, and remediation with a focus on AI, frontier models, agentic systems, and quantum threats.

The role partners with technology, risk, audit, compliance and regulators to ensure alignment with enterprise risk

Qualifications

• 10+ years of experience in cybersecurity risk management, technology risk, information security, or related fields.
• 5+ years of experience leading cybersecurity or risk management teams.
• Experience providing independent oversight and governance materials to executives and regulators.
• Strong knowledge of risk frameworks, governance practices, and industry standards.

Responsibilities

• Lead independent oversight of the enterprise cybersecurity risk management program.
• Develop executive dashboards, KRIs, and risk reporting for leadership and the Board.
• Assess governance, risk management practices, and control environments for cybersecurity.
• Provide credible challenge on risk assessments, remediation, and regulatory expectations.

Skills

Cybersecurity risk management

Executive communication

Regulatory engagement

Leadership

Education

Bachelor's degree or equivalent

Tools

Active Directory (AD)

Amazon Web Services (AWS)

Atlassian JIRA

CyberArk

Job description

Playing an essential role in the U.S. economy, Fannie Mae is foundational to housing finance. Here, your expertise can help fuel purpose-driven innovation that expands access to homeownership and affordable rental housing across the country. Join Fannie Mae to grow your career and help people find a place to call home.Job DescriptionThe Senior Director, Cybersecurity Risk Oversight Lead is responsible for advancing the Chief Risk and Compliance Division's (CRCD) independent cybersecurity risk oversight strategy. This role serves as a senior second line of defense (2LOD) leader responsible for overseeing cybersecurity risk governance, risk identification and assessment, risk appetite, issue management, emerging risk monitoring, regulatory engagement, and executive reporting.Serving as a strategic partner to enterprise leadership, technology teams, and control functions, this role provides independent oversight and credible challenge to ensure cybersecurity risks are effectively identified, measured, monitored, managed, and reported. The position provides transparency into the firm's cybersecurity risk posture, control effectiveness, remediation progress, and emerging threats while supporting informed decision-making by executive management, risk committees, and regulators.The role also oversees cybersecurity risks associated with emerging technologies, including artificial intelligence, frontier models, agentic systems, and quantum computing, ensuring risks are appropriately governed and aligned with enterprise risk appetite.THE IMPACT YOU WILL MAKECybersecurity Risk Oversight & GovernanceLead independent oversight and credible challenge of the enterprise cybersecurity risk management program.Assess the effectiveness of cybersecurity governance, risk management practices, and control environments.Provide independent review and challenge of cybersecurity strategies, risk assessments, exceptions, risk acceptances, and remediation plans.Evaluate cybersecurity risk exposures against approved risk appetite statements, limits, and thresholds.Identify material risk concentrations, systemic control weaknesses, and emerging risk trends.Promote accountability, transparency, and effective risk management across the enterprise.Cyber Risk Assessment, Monitoring & ReportingOversee the assessment, aggregation, monitoring, and reporting of cybersecurity risks across the enterprise.Establish and maintain cybersecurity risk metrics, key risk indicators (KRIs), and risk appetite measures.Monitor cybersecurity events, control deficiencies, audit findings, and issue remediation activities.Develop executive-level dashboards, scorecards, and risk reporting for senior leadership, risk committees, and the Board.Translate complex cybersecurity risks into clear business impacts and actionable recommendations.Emerging Technology & Cybersecurity Risk OversightProvide independent oversight of cybersecurity risks associated with artificial intelligence, frontier models, autonomous agents, and other emerging technologies.Assess risks related to AI-enabled cyber threats, adversarial attacks, model compromise, data exposure, and AI supply-chain vulnerabilities.Evaluate cybersecurity implications of advanced AI capabilities and emerging technology adoption across the enterprise.Lead oversight of enterprise preparedness for quantum computing threats and post-quantum cryptography transition efforts.Monitor emerging cyber threats, technology developments, and regulatory expectations to identify risks that may impact the firm's security posture.Issue Management, Regulatory Engagement & AssuranceProvide oversight of cybersecurity issues, corrective action plans, risk acceptances, and remediation activities.Review and challenge issue severity, root cause analysis, remediation effectiveness, and closure decisions.Support cybersecurity regulatory examinations, findings remediation, and supervisory commitments.Partner with Internal Audit, Compliance, and other assurance functions to assess cybersecurity risk management effectiveness.Escalate material cybersecurity risks, control concerns, and adverse trends through established governance channels.Executive Leadership & Stakeholder ManagementServe as a trusted cybersecurity risk advisor to executive leadership and governance committees.Build strong partnerships across technology, business, risk, audit, compliance, and regulatory stakeholders.Develop board level presentations and present cybersecurity risk perspectives and recommendations to senior leadership and Executive-level forums.Lead and develop a high-performing team of cybersecurity risk professionals.Foster a culture of accountability, transparency, continuous improvement, and sound risk management.Minimum Required Experiences10 or more years of experience in cybersecurity risk management, technology risk, information security, operational risk, audit, compliance, or related disciplines.5 or more years of experience leading cybersecurity, technology risk, or risk management teams.Experience providing independent oversight and credible challenge of cybersecurity risk management programs.Experience developing cybersecurity risk assessments, executive reporting, dashboards, and governance materials.Experience engaging with executive leadership, regulators, Internal Audit, and governance committees.Strong knowledge of cybersecurity risk management frameworks, governance practices, and industry standards.Strong written and verbal communication skills with the ability to communicate complex risks to executive audiences.Shows curiosity and adaptability in learning and responsibly applying new technologies to strengthen risk management practices.Curiosity and adaptability in learning and responsibly applying new technologies, including artificial intelligence, to reimagine how we work.Desired ExperiencesExperience in financial services or other highly regulated industries.Experience overseeing cybersecurity risks associated with artificial intelligence, machine learning, frontier models, agentic systems, or emerging technologies.Knowledge of AI security risks, adversarial AI threats, model security, and AI supply-chain risks.Knowledge of quantum computing risks and post-quantum cryptography migration considerations.Experience developing cybersecurity KRIs, risk appetite metrics, and risk governance frameworks.Knowledge of NIST CSF, NIST AI RMF, ISO 27001, COBIT, and related frameworks.Professional certifications such as CISSP, CISM, CRISC, or CISA.Bachelor's degree or equivalent.Qualifications Active Directory (AD), Active Directory (AD), Amazon Web Services (AWS), Artificial Intelligence (AI), Atlassian JIRA, Authentication Management, Backup and Recovery (Software), Business Insight Skills, Business Process Management Skills, Calendar and Scheduling Tools, Cleaning and Transforming Data, Cloud Technology, Collaborating Cross-Functionally, Communicating in Technical Writing, Communicating Technical Information, Communication, Configuration Management (CM), Conflict Resolution, Coordination, Customer and Market Insights, Customer Relationship Management (CRM), CyberArk, Cybersecurity Analysis, Data Analysis, Data Analysis Interpretation {+ 60 more}Education: Bachelor's Level Degree (Required), Master's Level DegreeThe future is what you make it to be. Discover compelling opportunities at Fanniemae.com/careers.For most roles, employees are expected to work onsite on a regular basis at their designated office location. In-office work cadence is determined by your manager. Proximity within a reasonable commute to your designated office location is preferred unless the job is noted as open to remote.Fannie Mae is an equal opportunity employer and considers qualified applicants for employment without regard to race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity/gender expression, marital or parental status, or any other protected factor. Fannie Mae is committed to providing reasonable accommodations to qualified individuals with disabilities who are employees or applicants for employment, unless to do so would cause undue hardship to the company. If you need assistance using our online system and/or you need a reasonable accommodation related to the hiring/application process, please complete this form .The hiring range for this role is set forth below. Final salaries will generally vary within that range based on factors that include but are not limited to, skill set, depth of experience, certifications, and other relevant qualifications. This position is eligible to participate in a Fannie Mae incentive program (subject to the terms of the program). As part of our comprehensive benefits package, Fannie Mae offers a broad range of Health, Life, Voluntary Lifestyle, and other benefits and perks that enhance an employee's physical, mental, emotional, and financial well-being. See more here .Requisition compensation: 200000to 269000