Principal Cybersecurity & Technology Risk Architect - AI/Cloud

Fannie Mae • Plano, TX

1d • $175,000 - $239,000 • Hybrid

About The Position

In this first-line risk role, you will serve as a senior technical risk authority for Enterprise Architecture, Artificial Intelligence (AI), Cloud and Engineering, providing independent, evidence-based risk challenge on the enterprise's most consequential technology decisions. You will partner with senior leaders and practitioners across Cybersecurity, Technology, Architecture, Engineering, Data, AI and Risk to identify and evaluate material cyber and technology risks before they are designed into the environment. You will translate complex technical conditions, emerging threats and incomplete evidence into clear risk positions that articulate the exposure, affected business capabilities, control effectiveness, uncertainty, accountable ownership and decisions required. The role requires deep technical credibility combined with enterprise risk judgment. You will evaluate architecture and engineering patterns, challenge security assumptions and control dependencies, identify systemic and emerging risks, and help leaders determine whether to proceed, proceed with conditions, redesign, remediate or formally accept risk. As a Principal, you will also serve as a senior integrator when risk crosses domains such as AI, cloud, identity, data, application security, cyber defense, resilience and third-party technology. You will help convert recurring exceptions and individual findings into reusable risk patterns, scalable control expectations, and enterprise-level actions.

Requirements

• 8 years of progressively responsible experience in cybersecurity, security architecture, cloud security, AI/ML security, years of relevant professional experience.
• Bachelor's degree or equivalent practical experience in cybersecurity, computer science, engineering, technology, risk or a related discipline.
• Demonstrated expertise in enterprise security architecture and modern engineering environments, including cloud architectures, APIs, identity and access patterns, data protection, application/platform security and software supply-chain risk.
• Demonstrated experience assessing AI/ML, Generative AI or emerging technology risk, including the security implications of models, data, AI applications, third-party AI services and increasingly autonomous/agentic systems.
• Experience conducting threat modeling, architecture risk assessments, control evaluations and scenario-based risk analysis for complex technology environments.
• Demonstrated ability to assess control design and operating effectiveness from technical evidence and distinguish control effectiveness from policy compliance or completion of risk-management activities.
• Experience translating complex technical vulnerabilities, architectural weaknesses and control gaps into business exposure and executive-level risk decisions.
• Working knowledge of relevant frameworks and practices such as NIST CSF, NIST 800-53, NIST AI RMF, NIST SSDF/SP 800 218, ISO 27001 and comparable cybersecurity and AI-risk frameworks.
• Demonstrated ability to operate effectively where evidence is incomplete, articulate assumptions and uncertainty, and reach defensible risk conclusions without false precision.
• Strong executive writing, synthesis and presentation skills, including the ability to communicate technical risk clearly to senior technology, cybersecurity, business and risk leaders.
• Demonstrated ability to provide constructive, credible challenges to senior engineers, architects and executives while maintaining productive working relationships and enabling business mission.
• Experience operating within a complex, regulated enterprise and navigating first-line ownership, independent risk oversight and audit/assurance accountability.

Nice To Haves

• Significant experience in financial services, critical infrastructure or another highly regulated industry, with an understanding of how cybersecurity, operational resilience and regulatory expectations intersect.
• Hands-on or architecture-level experience with public cloud environments and cloud-native security, including shared responsibility models, workload identity, containers/serverless services, APIs and modern software-delivery pipelines.
• Experience evaluating GenAI, RAG, AI agents, AI-enabled applications or ML platforms, including associated identity, data, model, tool-use, supply-chain and runtime risks.
• Experience with secure software development and DevSecOps, including software supply-chain controls, CI/CD security, secrets management, dependency risk and secure-by-design engineering practices.
• Experience establishing security architecture patterns, risk scenarios, reference controls or minimum evidence requirements that can be reused across an enterprise.
• Experience analyzing systemic and emerging risk, connecting multiple findings, exceptions, incidents or technical conditions into an enterprise-level risk theme and recommended action.
• Experience developing risk metrics and leading indicators that measure exposure and control effectiveness rather than activity volume.
• Experience presenting complex technology-risk positions to executive management, governance committees, auditors and/or regulators.
• Experience influencing material technology or investment decisions without direct ownership of engineering delivery.
• Experience coaching or mentoring senior cyber-risk or technology professionals; formal people-management experience is beneficial but not required.
• Certifications such as CISSP, CCSP, CISM, CRISC, SABSA or relevant cloud/security architecture credentials.
• Experience working with enterprise GRC platforms and workflows for risk assessments, issues, exceptions, control evidence, risk acceptance and remediation tracking.

Responsibilities

• Lead first-line risk analysis and credible challenges for material architecture, AI/GenAI, agentic AI, cloud and engineering decisions, translating technical complexity into clear enterprise risk positions and actionable decisions.
• Assess architecture and engineering risk early in the lifecycle, including security design, trust boundaries, threat scenarios, inherited controls, data flows, identity and privilege, APIs, cloud services, software supply chains and resilience dependencies.
• Provide senior risk challenge for AI systems and emerging AI architectures, including risks associated with model and data integrity, prompt injection, sensitive-data exposure, excessive agency, non-human identities, tool access, third-party models/components and agentic workflows.
• Evaluate control design and effectiveness using evidence, distinguishing implemented and effective controls from policies, activities, dashboards or assertions, and identifying where evidence or assurance remains insufficient.
• Develop reusable risk scenarios, assessment approaches and minimum evidence expectations for established and emerging technology patterns, reducing reliance on one-off reviews and enabling consistent risk decisions at scale.
• Interpret threat modeling and scenario analysis to identify credible failure modes, attack paths, concentration risks and business consequences across interconnected technology environments.
• Connect technical exposures to enterprise impact, including critical business services, sensitive data, operational resilience, regulatory obligations and strategic initiatives.
• Frame decision-ready recommendations for senior management, clearly articulating exposure, evidence, uncertainty, alternatives, conditions, accountable owners and the decision required.
• Identify systemic and emerging cyber risks by connecting signals across architecture reviews, risk assessments, incidents, issues, exceptions, audit findings, technology change and industry threat intelligence.
• Drive accountable remediation and sustainable risk reduction, challenging whether proposed corrective actions address root causes and validating that closure evidence demonstrates meaningful reduction in exposure.
• Partner across Cybersecurity, Technology, Engineering, Data, AI and Risk while maintaining independence of judgment and clear accountability boundaries.
• Serve as a senior technical risk integrator and mentor, raising the quality of risk reasoning, technical challenge and executive communication across the broader risk organization.

Benefits

• Health, Life, Voluntary Lifestyle, and other benefits and perks that enhance an employee's physical, mental, emotional, and financial well-being.
• Fannie Mae incentive program

What This Job Offers

• Job Type: Full-time
• Career Level: Principal