DirectJobHub
Jobs · Finance · Virginia

Enterprise Technology Risk - Risk Management - Senior Director

Fannie Mae · Reston, VA · 3 wk ago
FinanceFull-time
We need to output HTML fragment with sections: About the role? The posting includes description paragraphs. We need headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections where there is real specific content. We need to parse the posting: It includes job description paragraphs, then sections: THE IMPACT YOU WILL MAKE (subsections: Cybersecurity Risk Oversight & Governance, Cyber Risk Assessment, Monitoring & Reporting, Emerging Technology & Cybersecurity Risk Oversight, Issue Management, Regulatory Engagement & Assurance, Executive Leadership & Stakeholder Management). Then Minimum Required Experiences, Desired Experiences, Qualifications (list of many skills), Education, then compensation and benefits info. We need to map to required headings. - About the role: could be the introductory paragraph(s) before "Job Description". The posting starts: "Playing an essential role..." then "Job Description". So we can put that as About the role. - Responsibilities: The impact sections (the bullet-like paragraphs) can be responsibilities. We'll list them as
  • each bullet. - Requirements: Minimum Required Experiences. - Qualifications: maybe the list of skills (Active Directory etc.) and Education? Actually Qualifications heading often includes skills and education. But we have separate Education heading? Not required but we can include Education under Qualifications or separate. The instruction says use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can have Qualifications and Skills separate. The posting includes "Qualifications Active Directory (AD), ..." which is a huge list of skills. That could go under Skills. Education: Bachelor's Level Degree (Required), Master's Level Degree. - Benefits: The posting mentions benefits package: "As part of our comprehensive benefits package, Fannie Mae offers a broad range of Health, Life, Voluntary Lifestyle, and other benefits and perks...". That's specific enough to include Benefits. - Pay: The posting includes "The hiring range for this role is set forth below. Final salaries will generally vary within that range based on factors..." and then "Requisition Compensation 200000 to 269000". So we have pay range. - Schedule: The posting includes "For most roles, employees are expected to work onsite on a regular basis at their designated office location. In-office work cadence is determined by your manager. Proximity within a reasonable commute to your designated office location is preferred unless the job is noted as open to remote." That's schedule info. We must not include boilerplate like EEO, legal, application instructions. Remove duplicated lines. We must not create sections with filler like "commensurate with experience". We have actual content. Now produce HTML fragment: use

    for each section heading. Use

    for prose. Use

    • for lists. We need to preserve all substantive information; do not invent or summarize away detail. So we need to include the specifics: e.g., the responsibilities bullet points need to be captured exactly as in the posting? We can paraphrase? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we should keep the details, not omit. We can keep the sentences as they are, maybe as list items. We need to avoid repeating job title as heading. Not include Job ID. We'll output something like:

      About the role

      Playing an essential role in the U.S. economy, Fannie Mae is foundational to housing finance. Here, your expertise can help fuel purpose-driven innovation that expands access to homeownership and affordable rental housing across the country. Join Fannie Mae to grow your career and help people find a place to call home.

      Responsibilities

      • Lead independent oversight and credible challenge of the enterprise cybersecurity risk management program.
      • Assess the effectiveness of cybersecurity governance, risk management practices, and control environments.
      • Provide independent review and challenge of cybersecurity strategies, risk assessments, exceptions, risk acceptances, and remediation plans.
      • Evaluate cybersecurity risk exposures against approved risk appetite statements, limits, and thresholds.
      • Identify material risk concentrations, systemic control weaknesses, and emerging risk trends.
      • Promote accountability, transparency, and effective risk management across the enterprise.
      • Oversee the assessment, aggregation, monitoring, and reporting of cybersecurity risks across the enterprise.
      • Establish and maintain cybersecurity risk metrics, key risk indicators (KRIs), and risk appetite measures.
      • Monitor cybersecurity events, control deficiencies, audit findings, and issue remediation activities.
      • Develop executive-level dashboards, scorecards, and risk reporting for senior leadership, risk committees, and the Board.
      • Translate complex cybersecurity risks into clear business impacts and actionable recommendations.
      • Provide independent oversight of cybersecurity risks associated with artificial intelligence, frontier models, autonomous agents, and other emerging technologies.
      • Assess risks related to AI-enabled cyber threats, adversarial attacks, model compromise, data exposure, and AI supply-chain vulnerabilities.
      • Evaluate cybersecurity implications of advanced AI capabilities and emerging technology adoption across the enterprise.
      • Lead oversight of enterprise preparedness for quantum computing threats and post-quantum cryptography transition efforts.
      • Monitor emerging cyber threats, technology developments, and regulatory expectations to identify risks that may impact the firm's security posture.
      • Provide oversight of cybersecurity issues, corrective action plans, risk acceptances, and remediation activities.
      • Review and challenge issue severity, root cause analysis, remediation effectiveness, and closure decisions.
      • Support cybersecurity regulatory examinations, findings remediation, and supervisory commitments.
      • Partner with Internal Audit, Compliance, and other assurance functions to assess cybersecurity risk management effectiveness.
      • Escalate material cybersecurity risks, control concerns, and adverse trends through established governance channels.
      • Serve as a trusted cybersecurity risk advisor to executive leadership and governance committees.
      • Build strong partnerships across technology, business, risk, audit, compliance, and regulatory stakeholders.
      • Develop board level presentations and present cybersecurity risk perspectives and recommendations to senior leadership and Executive-level forums.
      • Lead and develop a high-performing team of cybersecurity risk professionals.
      • Foster a culture of accountability, transparency, continuous improvement, and sound risk management.

      Requirements

      • 10 or more years of experience in cybersecurity risk management, technology risk, information security, operational risk, audit, compliance, or related disciplines.
      • 5 or more years of experience leading cybersecurity, technology risk, or risk management teams.
      • Experience providing independent oversight and credible challenge of cybersecurity risk management programs.
      • Experience developing cybersecurity risk assessments, executive reporting, dashboards, and governance materials.
      • Experience engaging with executive leadership, regulators, Internal Audit, and governance committees.
      • Strong knowledge of cybersecurity risk management frameworks, governance practices, and industry standards.
      • Strong written and verbal communication skills with the ability to communicate complex risks to executive audiences.
      • Shows curiosity and adaptability in learning and responsibly applying new technologies to strengthen risk management practices.
      • Curiosity and adaptability in learning and responsibly applying new technologies, including artificial intelligence, to reimagine how we work.

      Skills

      Active Directory (AD), Active Directory (AD), Amazon Web Services (AWS), Artificial Intelligence (AI), Atlassian JIRA, Authentication Management, Backup and Recovery (Software), Business Insight Skills, Business Process Management Skills, Calendar and Scheduling Tools, Cleaning and Transforming Data, Cloud Technology, Collaborating Cross-Functionally, Communicating in Technical Writing, Communicating Technical Information, Communication, Configuration Management (CM), Conflict Resolution, Coordination, Customer and Market Insights, Customer Relationship Management (CRM), CyberArk, Cybersecurity Analysis, Data Analysis, Data Analysis Interpretation {+ 60 more}

      But we need to avoid duplication: "Active Directory (AD), Active Directory (AD)" appears twice in the posting; we should keep as is? It's duplicated in the source; we should preserve all substantive information, but duplicated lines maybe considered boilerplate? The instruction: "Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions." So we should remove duplicated lines. The duplicated "Active Directory (AD), Active Directory (AD)" is a duplicated line; we should deduplicate to just one occurrence. Also there may be other duplicates in the list; but we can just present the list as given but deduplicate obvious repeats. Safer to present the list as a single occurrence of each item. However we risk losing some info if the duplication was intentional (maybe they listed AD twice for emphasis). But instruction says remove duplicated lines. So we will deduplicate. We need to include the rest of the list exactly as given after deduplication. The list is long; we can't reproduce all 60+ items manually but we need to preserve ALL substantive information. That's impossible to list all manually. However we can note that the list includes many items; we could keep the phrase "{+ 60 more}" as is, which indicates there are more. The original: "Qualifications Active Directory (AD), Active Directory (AD), Amazon Web Services (AWS), Artificial Intelligence (AI), Atlassian JIRA, Authentication Management, Backup and Recovery (Software), Business Insight Skills, Business Process Management Skills, Calendar and Scheduling Tools, Cleaning and Transforming Data, Cloud Technology, Collaborating Cross-Functionally, Communicating in Technical Writing, Communicating Technical Information, Communication, Configuration Management (CM), Conflict Resolution, Coordination, Customer and Market Insights, Customer Relationship Management (CRM), CyberArk, Cybersecurity Analysis, Data Analysis, Data Analysis Interpretation {+ 60 more} Education Bachelor's Level Degree (Required), Master's Level Degree". So we can keep that string but deduplicate the duplicated AD. So we will output: "Active Directory (AD), Amazon Web Services (AWS), Artificial Intelligence (AI), Atlassian JIRA, Authentication Management, Backup and Recovery (Software), Business Insight Skills, Business Process Management Skills, Calendar and Scheduling Tools, Cleaning and Transforming Data, Cloud Technology, Collaborating Cross-Functionally, Communicating in Technical Writing, Communicating Technical Information, Communication, Configuration Management (CM), Conflict Resolution, Coordination, Customer and Market Insights, Customer Relationship Management (CRM), CyberArk, Cybersecurity Analysis, Data Analysis, Data Analysis Interpretation {+ 60 more}". That preserves the info. Now Education: "Bachelor's Level Degree (Required), Master's Level Degree". We'll put under Education heading? The instruction allows Education heading? Not listed but we can include under Qualifications or separate. Since they gave list of possible headings, Education is not listed but we could still include if we have content. However they said "Use

      for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." The e.g. implies those are examples, not exclusive. But safer to stick to those headings. We could put Education under Qualifications or Skills. Probably better to have a Qualifications section that includes both the skills list and education. But they also have Skills heading separate. We could put skills under Skills, education under Qualifications. Let's do: - Qualifications: includes the list of skills (the big list) and maybe also mention "Bachelor's Level Degree (Required), Master's Level Degree". But they also have Education heading not in examples; but we could still include Education as a heading if we have content. The instruction: "Use

Similar jobs