IT Risk Professional

Freddie Mac•McLean, VA

About The Position

This role is part of Freddie Mac’s Enterprise Operations & Technology Risk Management team, providing comprehensive risk management support with a focus on Identity and Access Management (IAM). The position works closely with the three lines of defense and business partners to reduce risk. It evaluates risks, assesses control adequacy, supports audits, and identifies opportunities to streamline IAM and other EO&T processes, including through AI capabilities. The role also supports leadership priorities around risk reduction, issue remediation, sustainability, and proactive identification of control and process gaps. The IT Risk Professional partners with IT stakeholders to understand and manage IAM-related risks and controls, provides risk exposure reporting to support decisions, and conducts gap and risk assessments. The role advises on remediation and manages issues from inception through closure, coordinates audits and examinations, and provides risk and control guidance across other EO&T processes as needed. The position is full-time and non-exempt. The annualized market-based salary range is $87,000–$131,000, with eligibility to participate in the annual incentive program. Freddie Mac describes its total rewards package as including competitive compensation and benefit programs; details are available on its Careers site.

Requirements

2–4 years of experience in risk, control, compliance, or operational risk.
Bachelor’s degree in Management Information Systems or Business Administration with an emphasis in Technology, Computer Science, Accounting Information Systems, or a related field, or equivalent overall experience.
Ability to collaborate effectively with upstream and downstream risk and controls stakeholders and influence outcomes.
Understanding of IAM solutions using SailPoint.
Ability to work effectively both in a team environment and individually.
Ability to work creatively and analytically in a problem-solving environment.
Self-motivation, a proactive problem-solving approach, and the capability to manage multiple priorities.

Nice To Haves

Experience in Internal Audit, Information Technology, or Identity and Access Management.
Understanding of NIST, SDLC, COBIT, ITIL, ISO, and IT General Controls.
Certification in, or active pursuit of, one or more relevant credentials such as CISA, CRISC, CISM, or CISSP.

Responsibilities

Partner with IT stakeholders to understand and manage risks and controls associated with IAM processes, serving as a liaison for the first line of defense.
Provide transparency into risk exposures through sound reporting that supports risk-based decision-making.
Perform gap assessments and risk assessments, advise on effective remediation, and drive issues from inception to closure.
Examine documented IAM processes and their associated risks and controls.
Provide risk insight on IAM principles, including user access lifecycle, access reviews and recertifications, role-based access control (RBAC), multi-factor authentication (MFA), separation of duties (SoD), just-in-time (JIT) access, and user authentication and authorization.
Ensure timely development of remediation action plans and support issue lifecycle management from inception to closure.
Coordinate audits and examinations, acting as a liaison between the first line of defense and oversight groups.
Provide risk and control guidance across other EO&T processes as needed.
Look for ways to streamline IAM and other EO&T processes, including by leveraging AI capabilities.
Support leadership priorities involving risk reduction, issue remediation, driving sustainability, and proactively identifying control and process gaps.