Fannie Mae — қаржы мен жылжымайтын мүлік салалары тоғысындағы қызмет атқаратын, мемлекет демеушілік ететін ұйым. Ол кредит берушілерден ипотекалық қарыздарды сатып алып, оларды ипотекамен қамтамасыз етілген бағалы қағаздарға біріктіреді және кредит берушілерді капитал нарығындағы инвесторлармен байланыстыруға көмектеседі. Осы қызметі арқылы Fannie Mae тұрғын үй сатып алу және жалға берілетін тұрғын үй нарықтарын өтімділікпен қамтамасыз етіп, тұрғын үйдің қолжетімділігі мен нарық тұрақтылығын кең ауқымда қолдайды. Оның ауқымды әрі әртүрлі мамандардан тұратын ұйымы бизнеске арналған қаржылық қызметтерге және тұрғын үй жылжымайтын мүлігін қаржыландырудың негізіндегі инфрақұрылымға үлес қосу мүмкіндіктерін ұсынады.
Principal Cybersecurity & Technology Risk Architect, AI and Cloud — Fannie Mae
Fannie Mae seeks a principal technology risk architect to challenge AI, cloud, and enterprise technology risks. The role translates technical evidence into executive decisions and accountable remediation.
Сипаттама
- Act as a senior technical risk authority across enterprise architecture, AI, cloud, and engineering.
- Provide independent, evidence-based first-line challenge for consequential technology decisions.
- Collaborate with Cybersecurity, Technology, Architecture, Engineering, Data, AI, and Risk stakeholders.
- Convert technical conditions, emerging threats, and incomplete evidence into clear enterprise risk positions.
- Assess architecture and engineering patterns, security assumptions, control dependencies, systemic risks, and emerging risks.
- Lead risk analysis for architecture, AI and generative AI, agentic AI, cloud, and engineering decisions.
- Review security design, trust boundaries, threat scenarios, inherited controls, data flows, identity, privilege, APIs, cloud services, software supply chains, and resilience dependencies.
- Assess AI-system risks involving model and data integrity, prompt injection, sensitive-data exposure, excessive agency, non-human identities, tool access, third-party models and components, and agentic workflows.
- Evaluate control design and effectiveness using technical evidence.
- Create reusable risk scenarios, assessment methods, and minimum evidence standards.
- Use threat modeling and scenario analysis to identify failure modes, attack paths, concentration risks, and business consequences.
- Relate technical exposures to critical services, sensitive data, operational resilience, regulatory obligations, and strategic initiatives.
- Develop recommendations that enable senior-management decisions.
- Identify systemic and emerging cyber risks across reviews, assessments, incidents, issues, exceptions, audit findings, technology changes, and threat intelligence.
- Drive accountable remediation and verify closure evidence.
- Integrate technical risk perspectives and mentor colleagues across the broader risk organization.
Талаптар
- At least eight years of progressively responsible experience in cybersecurity, security architecture, cloud security, AI/ML security, or a related professional field.
- Bachelor’s degree or equivalent practical experience in cybersecurity, computer science, engineering, technology, risk, or a related discipline.
- Demonstrated enterprise security architecture expertise spanning cloud architecture, APIs, identity and access, data protection, application and platform security, and software supply-chain risk.
- Experience evaluating AI/ML, generative AI, or other emerging technology risks.
- Background in threat modeling, architecture risk assessments, control evaluations, and scenario-based risk analysis.
- Ability to evaluate control design and operating effectiveness from technical evidence.
- Experience converting technical vulnerabilities, architectural weaknesses, and control gaps into business exposure and executive-level risk decisions.
- Working knowledge of NIST CSF, NIST 800-53, NIST AI RMF, NIST SSDF/SP 800-218, ISO 27001, and comparable frameworks.
- Ability to work with incomplete evidence while clearly stating assumptions and uncertainty.
- Strong executive writing, synthesis, and presentation capabilities.
- Ability to challenge senior engineers, architects, and executives constructively.
- Experience working in a complex, regulated enterprise.
- Experience in financial services, critical infrastructure, or another highly regulated industry is preferred.
- Public-cloud and cloud-native security experience is preferred.
- Experience with GenAI, RAG, AI agents, AI-enabled applications, or ML platforms is preferred.
- Experience with secure software development and DevSecOps is preferred.
- Experience establishing reusable security architecture patterns, risk scenarios, reference controls, or minimum evidence requirements is preferred.
- Experience analyzing systemic and emerging risk is preferred.
- Experience developing risk metrics and leading indicators is preferred.
- Experience presenting technology-risk positions to executives, governance committees, auditors, or regulators is preferred.
- Experience influencing material technology or investment decisions is preferred.
- Experience coaching or mentoring senior cyber-risk or technology professionals is preferred.
- Certifications such as CISSP, CCSP, CISM, CRISC, SABSA, or relevant cloud and security architecture credentials are preferred.
- Experience with enterprise GRC platforms and workflows is preferred.
Артықшылықтар
- Eligibility for an incentive program.
- Health benefits.
- Life benefits.
- Voluntary lifestyle benefits.
- Additional benefits and perks supporting physical, mental, emotional, and financial well-being.
- Flexible work arrangement through the Flex program.