VM Governance Analyst
About The Position
Playing an essential role in the U.S. economy, Fannie Mae is foundational to housing finance. Here, your expertise can help fuel purpose-driven innovation that expands access to homeownership and affordable rental housing across the country. Join Fannie Mae to grow your career and help people find a place to call home. Job Description THE IMPACT YOU WILL MAKE The VM Governance Analyst role will offer you the flexibility to make each day your own, while working alongside people who care so that you can deliver on the following responsibilities: Apply risk and controls frameworks to support vulnerability governance and oversight Ensure compliance with established risk frameworks, control requirements, and internal policy standards Assist in governance activities, risk assessments, and reporting processes Maintain vulnerability management standard, procedures, and guidelines Document and update process flows and workflow diagrams Support control effectiveness monitoring related to vulnerability remediation Gather, validate, and analyze vulnerability data for governance and leadership reporting Track remediation progress and SLA adherence across technology domains Identify vulnerabilities requiring risk escalation and exception review Prepare and present PowerPoint presentations for leadership, governance working groups and audit reviews Maintain documentation for risk acceptance, control validation, audit and regulatory reviews Produce recurring operational and executive-level metrics and dashboards Identify trends, systemic risks, and opportunities for process improvement
Requirements
- 2 years experience
- Understanding of cybersecurity vulnerabilities and remediation lifecycles
- Strong understanding of risk frameworks (e.g. NIST)
- Working knowledge and acknowledgement of controls frameworks (e.g. NIST, ISO27001, COBIT)
- Ability to support structured risk assessments (likelihood, impact, residual risk)
- Ability to ensure compliance with risk frameworks, control requirements, and standards
- Advanced Microsoft Excel skills (pivot tables, VLOOKUP, data cleansing, trend analysis)
- Strong PowerPoint presentation skills for leadership-level reporting
- Experience translating technical vulnerability data, analyzing large datasets and identify actionable risk-focused insights
- Strong technical writing skills with ability to draft standards, procedures, guidelines, and process documentation
- Ability to document and visualize process flows and governance workflows
Nice To Haves
- Bachelor degree or equivalent
- 5+ of experience in cybersecurity, vulnerability management, IT risk, audit, compliance, or governance-related roles
- Experience supporting vulnerability reporting, risk assessments, governance processes, drafting standards and procedures, or compliance activities preferred
- Experience working with metrics, dashboards, or executive-level reporting in an enterprise or regulated environment preferred
- Vulnerability governance and oversight experience
- Application of risk and controls frameworks
- Risk assessment support and risk documentation
- Governance reporting and compliance monitoring
- Process flow documentation and workflow mapping
- Risk-based escalation and exception tracking
- Metrics development and KRI tracking
- Dashboard development and data visualization
- Executive- level communication and presentation
- CISA (Certified Information Systems Auditor) – preferred
- CRISC (Certified in Risk and Information Systems Control) – preferred
- Security + or equivalent foundational security certification – a plus
Responsibilities
- Apply risk and controls frameworks to support vulnerability governance and oversight
- Ensure compliance with established risk frameworks, control requirements, and internal policy standards
- Assist in governance activities, risk assessments, and reporting processes
- Maintain vulnerability management standard, procedures, and guidelines
- Document and update process flows and workflow diagrams
- Support control effectiveness monitoring related to vulnerability remediation
- Gather, validate, and analyze vulnerability data for governance and leadership reporting
- Track remediation progress and SLA adherence across technology domains
- Identify vulnerabilities requiring risk escalation and exception review
- Prepare and present PowerPoint presentations for leadership, governance working groups and audit reviews
- Maintain documentation for risk acceptance, control validation, audit and regulatory reviews
- Produce recurring operational and executive-level metrics and dashboards
- Identify trends, systemic risks, and opportunities for process improvement
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
