Principal Cybersecurity & Technology Risk Architect - AI​/Cloud

Playing an essential role in the U.S. economy, Fannie Mae is foundational to housing finance. Here, your expertise can help fuel purpose-driven innovation that expands access to home ownership and affordable rental housing across the country. Join Fannie Mae to grow your career and help people find a place to call home.

Job Description

In this first-line risk role, you will serve as a senior technical risk authority for Enterprise Architecture, Artificial Intelligence (AI), Cloud and Engineering, providing independent, evidence-based risk challenge on the enterprise's most consequential technology decisions.

You will partner with senior leaders and practitioners across Cybersecurity, Technology, Architecture, Engineering, Data, AI and Risk to identify and evaluate material cyber and technology risks before they are designed into the environment. You will translate complex technical conditions, emerging threats and incomplete evidence into clear risk positions that articulate the exposure, affected business capabilities, control effectiveness, uncertainty, accountable ownership and decisions required.

The role requires deep technical credibility combined with enterprise risk judgment. You will evaluate architecture and engineering patterns, challenge security assumptions and control dependencies, identify systemic and emerging risks, and help leaders determine whether to proceed, proceed with conditions, redesign, remediate or formally accept risk.

As a Principal, you will also serve as a senior integrator when risk crosses domains such as AI, cloud, identity, data, application security, cyber defense, resilience and third-party technology. You will help convert recurring exceptions and individual findings into reusable risk patterns, scalable control expectations, and enterprise-level actions.

This Principal role will offer you the flexibility to make each day your own while working alongside people who care, so that you can deliver on the following responsibilities:

• Lead first-line risk analysis and credible challenges for material architecture, AI/GenAI, agentic AI, cloud and engineering decisions, translating technical complexity into clear enterprise risk positions and actionable decisions.
• Assess architecture and engineering risk early in the lifecycle, including security design, trust boundaries, threat scenarios, inherited controls, data flows, identity and privilege, APIs, cloud services, software supply chains and resilience dependencies.
• Provide senior risk challenge for AI systems and emerging AI architectures, including risks associated with model and data integrity, prompt injection, sensitive-data exposure, excessive agency, non-human identities, tool access, third-party models/components and agentic workflows.
• Evaluate control design and effectiveness using evidence, distinguishing implemented and effective controls from policies, activities, dashboards or assertions, and identifying where evidence or assurance remains insufficient.
• Develop reusable risk scenarios, assessment approaches and minimum evidence expectations for established and emerging technology patterns, reducing reliance on one-off reviews and enabling consistent risk decisions at scale.
• Interpret threat modeling and scenario analysis to identify credible failure modes, attack paths, concentration risks and business consequences across interconnected technology environments.
• Connect technical exposures to enterprise impact, including critical business services, sensitive data, operational resilience, regulatory obligations and strategic initiatives.
• Frame decision-ready recommendations for senior management, clearly articulating exposure, evidence, uncertainty, alternatives, conditions, accountable owners and the decision required.
• Identify systemic and emerging cyber risks by connecting signals across architecture reviews, risk assessments, incidents, issues, exceptions, audit findings, technology change and industry threat intelligence.
• Drive accountable remediation and sustainable risk reduction, challenging whether proposed corrective actions address root causes and validating that closure evidence demonstrates meaningful reduction in exposure.
• Partner across Cybersecurity, Technology, Engineering, Data, AI and Risk while maintaining independence of judgment and clear accountability boundaries.
• Serve as a senior technical risk integrator and mentor, raising the quality of risk reasoning, technical…