Principal Cybersecurity & Technology Risk Architect - AI/Cloud

The Fannie Mae; United States; On-site; USD 175,000 - 239,000; Full time

Job summary

The Fannie Mae seeks a Principal Risk role to serve as a senior technical risk authority for Enterprise Architecture, AI, Cloud and Engineering. You will translate complex threats into clear risk positions and drive enterprise-wide risk decisions with executive stakeholders.

You will partner across Cybersecurity, Technology, Architecture, Engineering, Data, AI and Risk to challenge design choices and embed robust risk practices into the development life cycle.

Qualifications

• 8 years of progressively responsible experience in cybersecurity, security architecture, cloud security, AI/ML security.
• Bachelor's degree or equivalent practical experience in cybersecurity, computer science, engineering, technology, risk or related field.
• Experience in enterprise security architecture and modern engineering environments, including cloud architectures and data protection.
• Experience assessing AI/ML/Generative AI risk and security implications of models and data.
• Experience threat modeling, architecture risk assessments and risk-based analysis for complex tech environments.
• Ability to translate vulnerabilities and control gaps into business exposure and executive decisions.
• Knowledge of NIST CSF, NIST 800-53, NIST AI RMF, ISO 27001 and related frameworks.
• Ability to operate with incomplete evidence and articulate uncertainties with defensible risk conclusions.
• Strong executive writing, synthesis and presentation skills for senior leaders.

Responsibilities

• Lead first-line risk analysis and credible challenges for architecture, AI/GenAI, cloud and engineering decisions.
• Assess risk early in the lifecycle, including security design, trust boundaries and data flows.
• Provide senior risk challenge for AI systems and emerging architectures with evidence-based reasoning.
• Evaluate control design and effectiveness using concrete evidence rather than policy alone.
• Develop reusable risk scenarios and minimum evidence expectations for emerging tech patterns.
• Interpret threat modeling to identify credible failure modes and business impact.
• Frame decision-ready recommendations for senior management with clear ownership.
• Identify systemic cyber risks by connecting signals across audits, incidents and changes.
• Drive remediation and measurable risk reduction across domains and teams.

Skills

Cybersecurity

Security architecture

Cloud security

AI/ML security

Threat modeling

Risk assessments

Control evaluations

Executive communication

GRC platforms

AI risk

Education

Bachelor's degree or equivalent

CISSP, CCSP, CISM, CRISC, SABSA (certifications)

Job description

Playing an essential role in the U.S. economy, Fannie Mae is foundational to housing finance. Here, your expertise can help fuel purpose-driven innovation that expands access to homeownership and affordable rental housing across the country. Join Fannie Mae to grow your career and help people find a place to call home.

Job Description

In this first-line risk role, you will serve as a senior technical risk authority for Enterprise Architecture, Artificial Intelligence (AI), Cloud and Engineering, providing independent, evidence-based risk challenge on the enterprise's most consequential technology decisions. You will partner with senior leaders and practitioners across Cybersecurity, Technology, Architecture, Engineering, Data, AI and Risk to identify and evaluate material cyber and technology risks before they are designed into the environment. You will translate complex technical conditions, emerging threats and incomplete evidence into clear risk positions that articulate the exposure, affected business capabilities, control effectiveness, uncertainty, accountable ownership and decisions required. The role requires deep technical credibility combined with enterprise risk judgment. You will evaluate architecture and engineering patterns, challenge security assumptions and control dependencies, identify systemic and emerging risks, and help leaders determine whether to proceed, proceed with conditions, redesign, remediate or formally accept risk. As a Principal, you will also serve as a senior integrator when risk crosses domains such as AI, cloud, identity, data, application security, cyber defense, resilience and third-party technology. You will help convert recurring exceptions and individual findings into reusable risk patterns, scalable control expectations, and enterprise-level actions.

The Way You Will Make a Difference

This Principal role will offer you the flexibility to make each day your own while working alongside people who care, so that you can deliver on the following responsibilities:

Lead first-line risk analysis and credible challenges for material architecture, AI/GenAI, agentic AI, cloud and engineering decisions, translating technical complexity into clear enterprise risk positions and actionable decisions.

Assess architecture and engineering risk early in the lifecycle, including security design, trust boundaries, threat scenarios, inherited controls, data flows, identity and privilege, APIs, cloud services, software supply chains and resilience dependencies.

Provide senior risk challenge for AI systems and emerging AI architectures, including risks associated with model and data integrity, prompt injection, sensitive-data exposure, excessive agency, non-human identities, tool access, third-party models/components and agentic workflows.

Evaluate control design and effectiveness using evidence, distinguishing implemented and effective controls from policies, activities, dashboards or assertions, and identifying where evidence or assurance remains insufficient.

Develop reusable risk scenarios, assessment approaches and minimum evidence expectations for established and emerging technology patterns, reducing reliance on one-off reviews and enabling consistent risk decisions at scale.

Interpret threat modeling and scenario analysis to identify credible failure modes, attack paths, concentration risks and business consequences across interconnected technology environments.

Connect technical exposures to enterprise impact, including critical business services, sensitive data, operational resilience, regulatory obligations and strategic initiatives.

Frame decision-ready recommendations for senior management, clearly articulating exposure, evidence, uncertainty, alternatives, conditions, accountable owners and the decision required.

Identify systemic and emerging cyber risks by connecting signals across architecture reviews, risk assessments, incidents, issues, exceptions, audit findings, technology change and industry threat intelligence.

Drive accountable remediation and sustainable risk reduction, challenging whether proposed corrective actions address root causes and validating that closure evidence demonstrates meaningful reduction in exposure.

Partner across Cybersecurity, Technology, Engineering, Data, AI and Risk while maintaining independence of judgment and clear accountability boundaries.

Serve as a senior technical risk integrator and mentor, raising the quality of risk reasoning, technical challenge and executive communication across the broader risk organization.

Minimum Required Qualifications

8 years of progressively responsible experience in cybersecurity, security architecture, cloud security, AI/ML security, years of relevant professional experience.

Bachelor's degree or equivalent practical experience in cybersecurity, computer science, engineering, technology, risk or a related discipline.

Demonstrated expertise in enterprise security architecture and modern engineering environments, including cloud architectures, APIs, identity and access patterns, data protection, application/platform security and software supply-chain risk.

Demonstrated experience assessing AI/ML, Generative AI or emerging technology risk, including the security implications of models, data, AI applications, third-party AI services and increasingly autonomous/agentic systems.

Experience conducting threat modeling, architecture risk assessments, control evaluations and scenario-based risk analysis for complex technology environments.

Demonstrated ability to assess control design and operating effectiveness from technical evidence and distinguish control effectiveness from policy compliance or completion of risk-management activities.

Experience translating complex technical vulnerabilities, architectural weaknesses and control gaps into business exposure and executive-level risk decisions.

Working knowledge of relevant frameworks and practices such as NIST CSF, NIST 800-53, NIST AI RMF, NIST SSDF/SP 800 218, ISO 27001 and comparable cybersecurity and AI-risk frameworks.

Demonstrated ability to operate effectively where evidence is incomplete, articulate assumptions and uncertainty, and reach defensible risk conclusions without false precision.

Strong executive writing, synthesis and presentation skills, including the ability to communicate technical risk clearly to senior technology, cybersecurity, business and risk leaders.

Demonstrated ability to provide constructive, credible challenges to senior engineers, architects and executives while maintaining productive working relationships and enabling business mission.

Experience operating within a complex, regulated enterprise and navigating first-line ownership, independent risk oversight and audit/assurance accountability.

Desired Experience

Significant experience in financial services, critical infrastructure or another highly regulated industry, with an understanding of how cybersecurity, operational resilience and regulatory expectations intersect.

Hands‑on or architecture-level experience with public cloud environments and cloud-native security, including shared responsibility models, workload identity, containers/serverless services, APIs and modern software-delivery pipelines.

Experience evaluating GenAI, RAG, AI agents, AI-enabled applications or ML platforms, including associated identity, data, model, tool-use, supply-chain and runtime risks.

Experience with secure software development and DevSecOps, including software supply-chain controls, CI/CD security, secrets management, dependency risk and secure‑by‑design engineering practices.

• Experience establishing security architecture patterns, risk scenarios, reference controls or minimum evidence requirements that can be reused across an enterprise.
• Experience analyzing systemic and emerging risk, connecting multiple findings, exceptions, incidents or technical conditions into an enterprise-level risk theme and recommended action.
• Experience developing risk metrics and leading indicators that measure exposure and control effectiveness rather than activity volume.
• Experience presenting complex technology‑risk positions to executive management, governance committees, auditors and/or regulators.
• Experience influencing material technology or investment decisions without direct ownership of engineering delivery.
• Experience coaching or mentoring senior cyber-risk or technology professionals; formal people‑management experience is beneficial but not required.
• Certifications such as CISSP, CCSP, CISM, CRISC, SABSA or relevant cloud/security architecture credentials.
• Experience working with enterprise GRC platforms and workflows for risk assessments, issues, exceptions, control evidence, risk acceptance and remediation tracking.

Target Salary Range

$175,000 to $239,000

Benefits

As part of our comprehensive benefits package, Fannie Mae offers a broad range of Health, Life, Voluntary Lifestyle, and other benefits and perks that enhance an employee's physical, mental, emotional, and financial well-being.

Diversity and Inclusion

Fannie Mae is an equal opportunity employer and considers qualified applicants for employment without regard to race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity/gender expression, marital or parental status, or any other protected factor.

Fannie Mae is committed to providing reasonable accommodations to qualified individuals with disabilities who are employees or applicants for employment, unless to do so would cause undue hardship to the company.

Incentives

This position is eligible to participate in a Fannie Mae incentive program (subject to the terms of the program).

Location and Work Arrangement

For most roles, employees are expected to work onsite on a regular basis at their designated office location. In‑office work cadence is determined by your manager. Proximity within a reasonable commute to your designated office location is preferred unless the job is noted as open to remote.

Additional Information

Requisition compensation: 175000 to 239000

Tackle America’s biggest housing challenges using the latest technology and AI, while collaborating with experts in their fields.

As a Fortune 25 company, Fannie Mae expands access to housing across America. Powered by the latest tech and AI, our innovative products and services drive the mortgage industry forward. We believe that prioritizing our people’s growth and success is essential to achieving our business goals and fulfilling our purpose.

Discover compelling opportunities at Fanniemae.com/careers.