Principal Security Engineer

Information Security Technology - Engineering - Principal

Playing an essential role in the U.S. economy, Fannie Mae is foundational to housing finance. Here, your expertise can help fuel purpose-driven innovation that expands access to homeownership and affordable rental housing across the country. Join Fannie Mae to grow your career and help people find a place to call home.

Fannie Mae is seeking a highly experienced Principal Security Engineer to serve as a senior technical authority for enterprise infrastructure security. This role leads the research, architecture, design, implementation, integration, and ongoing support of security capabilities spanning cloud, network, server, endpoint, application, DevSecOps, and artificial intelligence environments.

The ideal candidate combines deep cybersecurity, cloud, infrastructure, and network expertise with hands-on full-stack engineering experience. This role will shape enterprise-scale security architecture, automate and integrate controls, review code and configurations, secure AI-enabled systems, and communicate clear recommendations to engineers, business partners, and leaders.

The Principal Security Engineer role will offer you the flexibility to make each day your own, while working alongside people who care so that you can deliver on the following responsibilities:

Cybersecurity Engineering and Technical Leadership

• Lead the evaluation, architecture, implementation, integration, and lifecycle support of enterprise security solutions using established cybersecurity and engineering principles.

• Provide principal-level technical direction for projects, products, platforms, applications, and infrastructure; identify systemic risks and drive remediation from design through operations.

• Develop strategic recommendations on security technologies, architecture, implementation approaches, and long-term technical direction.

• Maintain expertise in evolving technologies, vulnerabilities, attack techniques, products, and industry trends; mentor engineers and influence decisions across teams without relying on direct authority.

• Promote security as an enabler of resilient technology delivery, cloud adoption, product innovation, and responsible AI.

Cloud and Infrastructure Security

• Define and implement security architecture, standards, reusable patterns, guardrails, and landing-zone controls across AWS, Google Cloud, Microsoft Azure, hybrid, and multi-cloud environments.

• Design identity-centric and zero-trust controls for segmentation, private connectivity, federation, encryption, key and secrets management, centralized logging, monitoring, and policy-driven governance.

• Secure virtual machines, containers, Kubernetes, serverless services, APIs, databases, storage, managed services, and data-processing platforms.

• Implement and operate cloud security posture, workload protection, entitlement management, configuration compliance, vulnerability management, and threat detection capabilities.

• Partner with platform teams to embed security through Infrastructure as Code, reusable modules, reference architectures, architecture reviews, migrations, and cloud-native modernization.

• Analyze configurations and telemetry to identify misconfigurations, excessive privilege, exposed services, policy violations, vulnerabilities, and indicators of compromise.

Server and Endpoint Security

• Establish hardening standards and configuration baselines for Windows, Linux, virtualized, containerized, and cloud-hosted server environments.

• Define and implement endpoint controls including EDR, anti-malware, host firewalls, encryption, application control, vulnerability management, privileged access management, and device posture validation.

• Improve visibility through centralized logging, monitoring, asset inventory, configuration management, vulnerability assessment, and security telemetry.

• Automate secure configuration, patching, vulnerability remediation, credential and certificate management, backup protection, recovery, remote administration, and system lifecycle processes.

• Evaluate, deploy, integrate, and operate server and endpoint security technologies; analyze findings and compliance results to prioritize remediation.

Application and Artificial Intelligence Security

• Lead application and AI security policies, standards, design patterns, control frameworks, and technical guardrails across traditional applications, machine-learning platforms, generative AI, and agentic systems.

• Architect and review secure designs for LLMs, foundation models, RAG pipelines, AI agents, tool-using workflows, automated decision-making, and AI-enabled business processes.

• Define controls for prompts, tools, agent memory, service identities, authorization, data access, autonomy limits, human approval, escalation and shutdown, observability, output validation, and content safety.

• Lead threat modeling, abuse-case and misuse analysis, red teaming, security testing, and risk assessments for AI pipelines, training and inference data, vector databases, retrieval systems, plugins, APIs, and external model providers.

Security Requirements, Architecture, and Documentation

• Develop and maintain security requirements, architecture artifacts, technical designs, implementation and test plans, policies, standards, procedures, control specifications, and operational documentation.

• Create architecture and data-flow diagrams, threat models, control mappings, integration designs, technical specifications, and support documentation.

• Translate regulatory, privacy, risk, business, and responsible AI obligations into measurable technical controls and acceptance criteria.

• Validate control implementation and effectiveness before production deployment and maintain accurate documentation of architecture, dependencies, data flows, configurations, support, and recovery processes.

• Define reusable reference architectures and secure design patterns for cloud, network, infrastructure, application, and AI environments.

Collaboration, Leadership, and Influence

• Partner across cybersecurity, engineering, product, cloud, infrastructure, networking, operations, application development, data, privacy, compliance, legal, architecture, and responsible AI teams.

• Influence product roadmaps, architecture decisions, development practices, and operating models while balancing security, privacy, compliance, cost, performance, availability, and delivery priorities.

• Lead technical discussions on architecture, engineering solutions, implementation options, platform capabilities, and risk tradeoffs.

• Build productive relationships with internal teams, technology vendors, managed service providers, and external support organizations; mentor senior and principal engineers and raise organizational security maturity.

Communication and Executive Engagement

• Communicate complex technical concepts to engineering, operations, product, risk, compliance, business, and executive audiences.

• Develop and deliver architecture presentations, technical briefings, risk assessments, implementation plans, engineering recommendations, and executive summaries.

• Facilitate design reviews, architecture forums, technical evaluations, incident discussions, and stakeholder decision meetings.

• Translate cybersecurity issues into business impact, risk exposure, operational considerations, tradeoffs, and actionable decisions.

• Address risks such as prompt injection, indirect prompt injection, sensitive-data leakage, insecure tool use, model poisoning, excessive privileges, hallucinated actions, and unsafe autonomous behavior.

• Partner with AI, product, application, data, privacy, legal, compliance, and responsible AI teams; evaluate emerging tools and standards; advise leadership on risk, regulation, investment, and roadmap priorities.

Security Requirements, Architecture, and Documentation

• Develop and maintain security requirements, architecture artifacts, technical designs, implementation and test plans, policies, standards, procedures, control specifications, and operational documentation.

• Create architecture and data-flow diagrams, threat models, control mappings, integration designs, technical specifications, and support documentation.

• Translate regulatory, privacy, risk, business, and responsible AI obligations into measurable technical controls and acceptance criteria.

• Validate control implementation and effectiveness before production deployment and maintain accurate documentation of architecture, dependencies, data flows, configurations, support, and recovery processes.

• Define reusable reference architectures and secure design patterns for cloud, network, infrastructure, application, and AI environments.

Collaboration, Leadership, and Influence

• Partner across cybersecurity, engineering, product, cloud, infrastructure, networking, operations, application development, data, privacy, compliance, legal, architecture, and responsible AI teams.

• Influence product roadmaps, architecture decisions, development practices, and operating models while balancing security, privacy, compliance, cost, performance, availability, and delivery priorities.

• Lead technical discussions on architecture, engineering solutions, implementation options, platform capabilities, and risk tradeoffs.

• Build productive relationships with internal teams, technology vendors, managed service providers, and external support organizations; mentor senior and principal engineers and raise organizational security maturity.

The Experience You Bring To The Team

Minimum Required Experiences

• 8 years of experience.
• Extensive experience in cybersecurity engineering, infrastructure or network security, cloud engineering, application security, software engineering, or a related technical discipline.
• Significant hands-on experience securing production environments in AWS, Google Cloud, and Microsoft Azure.
• Deep knowledge of cloud security architecture, IAM, networking, encryption, logging, monitoring, workload protection, governance, and enterprise network security, including segmentation, firewall