IT Risk Professional

Freddie Mac•McLean, VA

5d•$87,000 - $131,000

About The Position

This role is part of Freddie Mac’s Enterprise Operations & Technology Risk Management team, providing comprehensive risk management support with a focus on Identity and Access Management (IAM). The team works with all three lines of defense and business partners on risk-reduction activities. The professional evaluates risks, assesses control adequacy, supports audits, and identifies opportunities to streamline IAM and other EO&T processes, including through AI capabilities. The role also supports leadership priorities related to risk reduction, issue remediation, sustainability, and proactive identification of control and process gaps. The position partners with IT stakeholders to understand IAM risks and controls, provides risk exposure reporting for decision-making, and conducts gap and risk assessments. It provides guidance on IAM principles and other EO&T processes, supports remediation action plans and issue lifecycle management, and coordinates audits and examinations as a liaison between first-line stakeholders and oversight groups.

Requirements

2–4 years of experience in risk, control, compliance, or operational risk.
Bachelor’s degree in Management Information Systems or Business Administration with an emphasis in Technology, Computer Science, Accounting Information Systems, or a related field, or equivalent overall experience.
Ability to collaborate effectively with upstream and downstream risk and controls stakeholders and influence outcomes.
Understanding of IAM solutions using SailPoint.
Ability to work effectively both in a team environment and individually.
Ability to work creatively and analytically in a problem-solving environment.
Self-motivation, proactive problem-solving, and ability to manage multiple priorities.

Nice To Haves

Experience in Internal Audit, Information Technology, or Identity and Access Management.
Understanding of NIST, SDLC, COBIT, ITIL, ISO, and IT General Controls.
Certification in, or active pursuit of, CISA, CRISC, CISM, CISSP, or another relevant credential.

Responsibilities

Examine documented identity and access management processes and their associated risks and controls.
Provide risk insight on IAM principles, including user access lifecycle, access reviews and recertifications, Role-Based Access Control (RBAC), Multi-Factor Authentication (MFA), Separation of Duties (SoD), Just-in-Time (JIT) access, and user authentication and authorization.
Ensure timely development of remediation action plans and support issue lifecycle management from inception to closure.
Coordinate audits and examinations, acting as a liaison between first-line stakeholders and oversight groups.
Provide risk and control guidance across other EO&T processes as needed.
Partner with IT stakeholders to understand and manage risks and controls associated with IAM processes, serving as a liaison for 1LOD.
Implement reporting that provides transparency into risk exposures to support risk-based decision-making.
Perform gap and risk assessments and advise on effective remediation.
Identify opportunities to streamline processes, including by leveraging AI capabilities.