Senior Director – Head of Cyber Security Risk, Technology and Operations Risk Management

Fannie Mae

Senior Director of Cybersecurity Risk at Fannie Mae, shaping cyber risk management strategy and execution across the enterprise. Enhancing organizational resilience by managing cyber, compliance, and operational risks.

Posted 5/22/2026full-timePlano • Texas, Virginia, Washington • 🇺🇸 United StatesSenior💰 $200,000 - $269,000 per yearWebsite

Tech Stack

Tools & technologies

Cyber Security

About the role

Key responsibilities & impact

Develop and execute the enterprise cybersecurity risk management strategy, including supporting policies, processes, and initiatives aligned to firm standards, regulatory requirements, and industry best practices.
Lead enterprise cyber risk identification, assessment, prioritization, and mitigation, including ownership of the annual top cyber risk assessment and ongoing maturity of risk methodologies.
Oversee cybersecurity risk governance, reporting, issue management, and control effectiveness, providing clear insights to senior leaders and governance forums.
Define and standardize governance reporting standards, templates, cadence, and content expectations to ensure consistency, clarity, and comparability of cyber risk reporting.
Coordinate cyber risk governance alignment across the CISO organization, ORM, IT, audit, and other stakeholders to ensure consistent interpretation and application of risk standards.
Establish and maintain strong relationships with internal and external stakeholders, including cross-functional leaders, regulators, and auditors.
Support alignment with applicable regulatory and industry cybersecurity risk management frameworks and expectations (e.g., FHFA, FFIEC, NIST CSF, CRI Profile, or equivalent).
Support Cyber Risk Institute (CRI) maturity and controls assessments, including coordination with internal stakeholders and external auditors.
Drive traceability, documentation, and auditability of cyber risk outputs, ensuring evidence and decision logic meet regulatory, internal audit, and examination standards.

Requirements

What you’ll need

15+ years of experience in cybersecurity, technology risk, or related risk disciplines
Bachelor's degree or equivalent professional experience
Demonstrated experience engaging senior executives and regulatory stakeholders
Shows curiosity and adaptability in learning and responsibly applying new technologies, including artificial intelligence, to reimagine how we work.
Preferred Qualifications Master’s degree
Professional certifications such as CISSP, CISA, or CRISC.

Benefits

Comp & perks

Health
Life
Voluntary Lifestyle
Other benefits and perks that enhance an employee's physical, mental, emotional, and financial well-being

ATS Keywords

✓ Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

cybersecurity risk managementrisk identificationrisk assessmentrisk prioritizationrisk mitigationgovernance reportingdocumentationauditabilitycontrol effectivenessmaturity assessments

Soft Skills

leadershipcommunicationrelationship buildingadaptabilitycuriositystakeholder engagementcollaborationinsight generationproblem-solvingstrategic thinking

Certifications

CISSPCISACRISCMaster's degreeBachelor's degree