Principal Security Engineer

About this role

Playing an essential role in the U.S. economy, Fannie Mae is foundational to housing finance. Here, your expertise can help fuel purpose-driven innovation that expands access to homeownership and affordable rental housing across the country. Join Fannie Mae to grow your career and help people find a place to call home.

Job Description

Fannie Mae is seeking a highly experienced Principal Security Engineer to serve as a senior technical authority for enterprise infrastructure security. This role leads the research, architecture, design, implementation, integration, and ongoing support of security capabilities spanning cloud, network, server, endpoint, application, DevSecOps, and artificial intelligence environments.

The ideal candidate combines deep cybersecurity, cloud, infrastructure, and network expertise with hands-on full-stack engineering experience. This role will shape enterprise-scale security architecture, automate and integrate controls, review code and configurations, secure AI-enabled systems, and communicate clear recommendations to engineers, business partners, and leaders.

THE IMPACT YOU WILL MAKE    The Principal Security Engineer role will offer you the flexibility to make each day your own, while working alongside people who care so that you can deliver on the following responsibilities: 

  Cybersecurity Engineering and Technical Leadership • Lead the evaluation, architecture, implementation, integration, and lifecycle support of enterprise security solutions using established cybersecurity and engineering principles. • Provide principal-level technical direction for projects, products, platforms, applications, and infrastructure; identify systemic risks and drive remediation from design through operations. • Develop strategic recommendations on security technologies, architecture, implementation approaches, and long-term technical direction. • Maintain expertise in evolving technologies, vulnerabilities, attack techniques, products, and industry trends; mentor engineers and influence decisions across teams without relying on direct authority. • Promote security as an enabler of resilient technology delivery, cloud adoption, product innovation, and responsible AI.

Cloud and Infrastructure Security • Define and implement security architecture, standards, reusable patterns, guardrails, and landing-zone controls across AWS, Google Cloud, Microsoft Azure, hybrid, and multi-cloud environments. • Design identity-centric and zero-trust controls for segmentation, private connectivity, federation, encryption, key and secrets management, centralized logging, monitoring, and policy-driven governance. • Secure virtual machines, containers, Kubernetes, serverless services, APIs, databases, storage, managed services, and data-processing platforms. • Implement and operate cloud security posture, workload protection, entitlement management, configuration compliance, vulnerability management, and threat detection capabilities. • Partner with platform teams to embed security through Infrastructure as Code, reusable modules, reference architectures, architecture reviews, migrations, and cloud-native modernization. • Analyze configurations and telemetry to identify misconfigurations, excessive privilege, exposed services, policy violations, vulnerabilities, and indicators of compromise.

Server and Endpoint Security • Establish hardening standards and configuration baselines for Windows, Linux, virtualized, containerized, and cloud-hosted server environments. • Define and implement endpoint controls including EDR, anti-malware, host firewalls, encryption, application control, vulnerability management, privileged access management, and device posture validation. • Improve visibility through centralized logging, monitoring, asset inventory, configuration management, vulnerability assessment, and security telemetry. • Automate secure configuration, patching, vulnerability remediation, credential and certificate management, backup protection, recovery, remote administration, and system lifecycle processes. • Evaluate, deploy, integrate, and operate server and endpoint security technologies; analyze findings and compliance results to prioritize remediation.

Application and Artificial Intelligence Security • Lead application and AI security policies, standards, design patterns, control frameworks, and technical guardrails across traditional applications, machine-learning platforms, generative AI, and agentic systems. • Architect and review secure designs for LLMs, foundation models, RAG pipelines, AI agents, tool-using workflows, automated decision-making, and AI-enabled business processes. • Define controls for prompts, tools, agent memory, service identities, authorization, data access, autonomy limits, human approval, escalation and shutdown, observability, output validation, and content safety. • Lead threat modeling, abuse-case and misuse analysis, red teaming, security testing, and risk assessments for AI pipelines, training and inference data, vector databases, retrieval systems, plugins, APIs, and external model providers.

Security Requirements, Architecture, and Documentation • Develop and maintain security requirements, architecture artifacts, technical designs, implementation and test plans, policies, standards, procedures, control specifications, and operational documentation. • Create architecture and data-flow diagrams, threat models, control mappings, integration designs, technical specifications, and support documentation. • Translate regulatory, privacy, risk, business, and responsible AI obligations into measurable technical controls and acceptance criteria. • Validate control implementation and effectiveness before production deployment and maintain accurate documentation of architecture, dependencies, data flows, configurations, support, and recovery processes. • Define reusable reference architectures and secure design patterns for cloud, network, infrastructure, appl

Similar jobs

• Principal Security Engineer — Candidhealth · San Francisco (CA), Denver (CO), New York (NY)
• Principal Security Engineer — Seesaw · Remote
• Principal Security Engineer — Intersystems · Boston, MA
• Principal Security Field Engineer — Databricks · Remote
• Principal Security Engineer, Security Platform — Equinix · Dallas Infomart Office DAI
• Principal Security Engineer, Infrastructure Security — Openai · Remote
• Principal Security Operations Engineer — Axon · Atlanta, Georgia, United States; Boston, Massachusetts, United States; San Francisco, California, United States; Scottsdale, Arizona, United States; Seattle, Washington, United States
• Principal Security Software Engineer, Application Security — Roblox · San Mateo, CA, United States