Fannie Mae moliya va ko‘chmas mulk sohalari kesishmasida faoliyat yurituvchi, hukumat tomonidan qo‘llab-quvvatlanadigan tashkilotdir. U kreditorlardan ipoteka kreditlarini sotib olib, ularni ipoteka bilan ta’minlangan qimmatli qog‘ozlarga birlashtiradi hamda kreditorlarni kapital bozorlaridagi investorlar bilan bog‘lashga yordam beradi. Fannie Mae shu faoliyati orqali uy-joy sotib olish va ijaraga beriladigan uy-joy bozorlariga likvidlik taqdim etib, uy-joyning yanada hamyonbop bo‘lishi va bozor barqarorligini qo‘llab-quvvatlaydi. Uning yirik va turli yo‘nalishlarni qamrab olgan tashkiloti bizneslararo moliyaviy xizmatlar hamda turar joy ko‘chmas mulkini moliyalashtirish asosidagi infratuzilmaga hissa qo‘shish imkoniyatlarini taqdim etadi.
Principal Cybersecurity & Technology Risk Architect, AI and Cloud — Fannie Mae
Fannie Mae seeks a principal technology risk architect to challenge AI, cloud, and enterprise technology risks. The role translates technical evidence into executive decisions and accountable remediation.
Tavsif
- Act as a senior technical risk authority across enterprise architecture, AI, cloud, and engineering.
- Provide independent, evidence-based first-line challenge for consequential technology decisions.
- Collaborate with Cybersecurity, Technology, Architecture, Engineering, Data, AI, and Risk stakeholders.
- Convert technical conditions, emerging threats, and incomplete evidence into clear enterprise risk positions.
- Assess architecture and engineering patterns, security assumptions, control dependencies, systemic risks, and emerging risks.
- Lead risk analysis for architecture, AI and generative AI, agentic AI, cloud, and engineering decisions.
- Review security design, trust boundaries, threat scenarios, inherited controls, data flows, identity, privilege, APIs, cloud services, software supply chains, and resilience dependencies.
- Assess AI-system risks involving model and data integrity, prompt injection, sensitive-data exposure, excessive agency, non-human identities, tool access, third-party models and components, and agentic workflows.
- Evaluate control design and effectiveness using technical evidence.
- Create reusable risk scenarios, assessment methods, and minimum evidence standards.
- Use threat modeling and scenario analysis to identify failure modes, attack paths, concentration risks, and business consequences.
- Relate technical exposures to critical services, sensitive data, operational resilience, regulatory obligations, and strategic initiatives.
- Develop recommendations that enable senior-management decisions.
- Identify systemic and emerging cyber risks across reviews, assessments, incidents, issues, exceptions, audit findings, technology changes, and threat intelligence.
- Drive accountable remediation and verify closure evidence.
- Integrate technical risk perspectives and mentor colleagues across the broader risk organization.
Talablar
- At least eight years of progressively responsible experience in cybersecurity, security architecture, cloud security, AI/ML security, or a related professional field.
- Bachelor’s degree or equivalent practical experience in cybersecurity, computer science, engineering, technology, risk, or a related discipline.
- Demonstrated enterprise security architecture expertise spanning cloud architecture, APIs, identity and access, data protection, application and platform security, and software supply-chain risk.
- Experience evaluating AI/ML, generative AI, or other emerging technology risks.
- Background in threat modeling, architecture risk assessments, control evaluations, and scenario-based risk analysis.
- Ability to evaluate control design and operating effectiveness from technical evidence.
- Experience converting technical vulnerabilities, architectural weaknesses, and control gaps into business exposure and executive-level risk decisions.
- Working knowledge of NIST CSF, NIST 800-53, NIST AI RMF, NIST SSDF/SP 800-218, ISO 27001, and comparable frameworks.
- Ability to work with incomplete evidence while clearly stating assumptions and uncertainty.
- Strong executive writing, synthesis, and presentation capabilities.
- Ability to challenge senior engineers, architects, and executives constructively.
- Experience working in a complex, regulated enterprise.
- Experience in financial services, critical infrastructure, or another highly regulated industry is preferred.
- Public-cloud and cloud-native security experience is preferred.
- Experience with GenAI, RAG, AI agents, AI-enabled applications, or ML platforms is preferred.
- Experience with secure software development and DevSecOps is preferred.
- Experience establishing reusable security architecture patterns, risk scenarios, reference controls, or minimum evidence requirements is preferred.
- Experience analyzing systemic and emerging risk is preferred.
- Experience developing risk metrics and leading indicators is preferred.
- Experience presenting technology-risk positions to executives, governance committees, auditors, or regulators is preferred.
- Experience influencing material technology or investment decisions is preferred.
- Experience coaching or mentoring senior cyber-risk or technology professionals is preferred.
- Certifications such as CISSP, CCSP, CISM, CRISC, SABSA, or relevant cloud and security architecture credentials are preferred.
- Experience with enterprise GRC platforms and workflows is preferred.
Imtiyozlar
- Eligibility for an incentive program.
- Health benefits.
- Life benefits.
- Voluntary lifestyle benefits.
- Additional benefits and perks supporting physical, mental, emotional, and financial well-being.
- Flexible work arrangement through the Flex program.