Fannie Mae este o entitate susținută de guvern, care activează la intersecția dintre finanțe și sectorul imobiliar. Sprijină sistemul de finanțare a locuințelor din Statele Unite prin achiziționarea de credite ipotecare de la creditori, gruparea acestora în titluri garantate cu ipoteci și facilitarea legăturii dintre creditori și investitorii de pe piețele de capital. Prin această activitate, Fannie Mae asigură lichiditate pentru piețele locuințelor cumpărate și închiriate, sprijinind în același timp accesibilitatea mai largă a locuințelor și stabilitatea pieței. Organizația sa mare și multidisciplinară oferă oportunități de a contribui la servicii financiare între companii și la infrastructura din spatele finanțării imobiliare rezidențiale.
Principal Cybersecurity & Technology Risk Architect, AI and Cloud — Fannie Mae
Fannie Mae seeks a principal technology risk architect to challenge AI, cloud, and enterprise technology risks. The role translates technical evidence into executive decisions and accountable remediation.
Descriere
- Act as a senior technical risk authority across enterprise architecture, AI, cloud, and engineering.
- Provide independent, evidence-based first-line challenge for consequential technology decisions.
- Collaborate with Cybersecurity, Technology, Architecture, Engineering, Data, AI, and Risk stakeholders.
- Convert technical conditions, emerging threats, and incomplete evidence into clear enterprise risk positions.
- Assess architecture and engineering patterns, security assumptions, control dependencies, systemic risks, and emerging risks.
- Lead risk analysis for architecture, AI and generative AI, agentic AI, cloud, and engineering decisions.
- Review security design, trust boundaries, threat scenarios, inherited controls, data flows, identity, privilege, APIs, cloud services, software supply chains, and resilience dependencies.
- Assess AI-system risks involving model and data integrity, prompt injection, sensitive-data exposure, excessive agency, non-human identities, tool access, third-party models and components, and agentic workflows.
- Evaluate control design and effectiveness using technical evidence.
- Create reusable risk scenarios, assessment methods, and minimum evidence standards.
- Use threat modeling and scenario analysis to identify failure modes, attack paths, concentration risks, and business consequences.
- Relate technical exposures to critical services, sensitive data, operational resilience, regulatory obligations, and strategic initiatives.
- Develop recommendations that enable senior-management decisions.
- Identify systemic and emerging cyber risks across reviews, assessments, incidents, issues, exceptions, audit findings, technology changes, and threat intelligence.
- Drive accountable remediation and verify closure evidence.
- Integrate technical risk perspectives and mentor colleagues across the broader risk organization.
Cerințe
- At least eight years of progressively responsible experience in cybersecurity, security architecture, cloud security, AI/ML security, or a related professional field.
- Bachelor’s degree or equivalent practical experience in cybersecurity, computer science, engineering, technology, risk, or a related discipline.
- Demonstrated enterprise security architecture expertise spanning cloud architecture, APIs, identity and access, data protection, application and platform security, and software supply-chain risk.
- Experience evaluating AI/ML, generative AI, or other emerging technology risks.
- Background in threat modeling, architecture risk assessments, control evaluations, and scenario-based risk analysis.
- Ability to evaluate control design and operating effectiveness from technical evidence.
- Experience converting technical vulnerabilities, architectural weaknesses, and control gaps into business exposure and executive-level risk decisions.
- Working knowledge of NIST CSF, NIST 800-53, NIST AI RMF, NIST SSDF/SP 800-218, ISO 27001, and comparable frameworks.
- Ability to work with incomplete evidence while clearly stating assumptions and uncertainty.
- Strong executive writing, synthesis, and presentation capabilities.
- Ability to challenge senior engineers, architects, and executives constructively.
- Experience working in a complex, regulated enterprise.
- Experience in financial services, critical infrastructure, or another highly regulated industry is preferred.
- Public-cloud and cloud-native security experience is preferred.
- Experience with GenAI, RAG, AI agents, AI-enabled applications, or ML platforms is preferred.
- Experience with secure software development and DevSecOps is preferred.
- Experience establishing reusable security architecture patterns, risk scenarios, reference controls, or minimum evidence requirements is preferred.
- Experience analyzing systemic and emerging risk is preferred.
- Experience developing risk metrics and leading indicators is preferred.
- Experience presenting technology-risk positions to executives, governance committees, auditors, or regulators is preferred.
- Experience influencing material technology or investment decisions is preferred.
- Experience coaching or mentoring senior cyber-risk or technology professionals is preferred.
- Certifications such as CISSP, CCSP, CISM, CRISC, SABSA, or relevant cloud and security architecture credentials are preferred.
- Experience with enterprise GRC platforms and workflows is preferred.
Beneficii
- Eligibility for an incentive program.
- Health benefits.
- Life benefits.
- Voluntary lifestyle benefits.
- Additional benefits and perks supporting physical, mental, emotional, and financial well-being.
- Flexible work arrangement through the Flex program.