Principal Cybersecurity, Technology Risk Architect – AI/Cloud

Fannie Mae

. Serve as a senior technical risk authority for Enterprise Architecture, AI, Cloud, and Engineering .

Posted 10/8/2026full-timeRemote • United StatesLead💰 $175,000 - $239,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cybersecurity and risk management, with a focus on enterprise security architecture, AI/ML security, and cloud security. Capable of conducting thorough risk assessments, threat modeling, and translating technical vulnerabilities into business risks for executive decision-making.

Highest-signal resume keywords

Cybersecurity ExpertiseEnterprise Security ArchitectureThreat ModelingRisk AssessmentExecutive Communication

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

CybersecuritySecurity ArchitectureCloud SecurityAI/ML SecurityThreat ModelingControl EvaluationRisk AnalysisData ProtectionApplication SecuritySoftware Supply Chain Risk

Soft Skills

Executive WritingPresentation SkillsConstructive ChallengeMentoring

Tools & Technologies

NIST CSFNIST 800-53ISO 27001Enterprise GRC Platforms

Certifications & Qualifications

CISSPCCSPCISMCRISCSABSA

Industry Keywords

Financial ServicesCritical InfrastructureRegulated IndustryCloud-Native SecurityGenAIDevSecOps

Tech Stack

Tools & technologies

CloudCyber Security

About the role

Key responsibilities & impact

Serve as a senior technical risk authority for Enterprise Architecture, AI, Cloud, and Engineering
Lead first-line risk analysis and credible challenges for material architecture, AI/GenAI, agentic AI, cloud, and engineering decisions
Assess architecture and engineering risk early in the lifecycle, including security design, trust boundaries, threat scenarios, inherited controls, data flows, identity, privilege, APIs, cloud services, software supply chains, and resilience dependencies
Provide senior risk challenge for AI systems and emerging AI architectures
Evaluate control design and effectiveness using evidence
Develop reusable risk scenarios, assessment approaches, and minimum evidence expectations
Interpret threat modeling and scenario analysis to identify failure modes, attack paths, concentration risks, and business consequences
Connect technical exposures to enterprise impact, including critical business services, sensitive data, resilience, regulatory obligations, and strategic initiatives
Frame decision-ready recommendations for senior management
Identify systemic and emerging cyber risks across architecture reviews, assessments, incidents, issues, exceptions, audits, technology change, and threat intelligence
Drive accountable remediation and validate closure evidence
Partner across Cybersecurity, Technology, Engineering, Data, AI, and Risk while maintaining independent judgment
Serve as a senior technical risk integrator and mentor across the risk organization

Requirements

What you’ll need

8 years of progressively responsible experience in cybersecurity, security architecture, cloud security, AI/ML security, or related professional experience
Bachelor's degree or equivalent practical experience in cybersecurity, computer science, engineering, technology, risk, or a related discipline
Enterprise security architecture expertise, including cloud architectures, APIs, identity and access patterns, data protection, application/platform security, and software supply-chain risk
Experience assessing AI/ML, Generative AI, or emerging technology risk
Experience conducting threat modeling, architecture risk assessments, control evaluations, and scenario-based risk analysis
Ability to assess control design and operating effectiveness from technical evidence
Ability to translate technical vulnerabilities, architectural weaknesses, and control gaps into business exposure and executive-level risk decisions
Working knowledge of NIST CSF, NIST 800-53, NIST AI RMF, NIST SSDF/SP 800 218, ISO 27001, and comparable frameworks
Ability to operate effectively with incomplete evidence and articulate assumptions and uncertainty
Strong executive writing, synthesis, and presentation skills
Ability to provide constructive challenges to senior engineers, architects, and executives
Experience in a complex, regulated enterprise and understanding of first-line ownership, independent risk oversight, and audit/assurance accountability
Desired: experience in financial services, critical infrastructure, or another highly regulated industry
Desired: public cloud and cloud-native security experience
Desired: GenAI, RAG, AI agents, AI-enabled applications, or ML platforms experience
Desired: secure software development and DevSecOps experience
Desired: experience establishing security architecture patterns, risk scenarios, reference controls, or minimum evidence requirements
Desired: systemic and emerging risk analysis experience
Desired: risk metrics and leading indicators experience
Desired: executive management, governance committee, auditor, or regulator presentation experience
Desired: experience influencing material technology or investment decisions
Desired: coaching or mentoring experience
Desired: certifications such as CISSP, CCSP, CISM, CRISC, SABSA, or relevant cloud/security architecture credentials
Desired: enterprise GRC platforms and workflows experience

Benefits

Comp & perks

Eligible to participate in a Fannie Mae incentive program
Comprehensive benefits package including Health, Life, Voluntary Lifestyle, and other benefits
Benefits and perks supporting physical, mental, emotional, and financial well-being
Open to remote work