Cyber leadership profile

Fannie Mae

Fannie Mae is a government-sponsored enterprise that provides liquidity, stability, and affordability to the U.S. housing market by purchasing mortgages from lenders. It operates in the secondary mortgage market, managing trillions of dollars in assets and supporting millions of homeowners and renters. For a security leader, the organization represents a critical component of national financial infrastructure operating under strict federal oversight and regulatory requirements.

Industry: Financial Services
Headcount: 5,001-10,000 employees
Headquarters: Washington, D.C.
Ownership: Government · OTCQB:FNMA
Revenue: Over $10B
Funding: Publicly traded
Founded: 1938

Cyber hiring activity

Open leadership roles

1 at Director level or above

Opened, last 12 months

2 Director+

Prior 12 months

Hiring velocity

Moderate

Median Opportunity Score 81

2 leadership roles observed in the last 12 months. CLI has no coverage of the prior year for this employer. Counts reflect roles Fannie Mae posted that CLI has observed and published; they are not a complete record of the employer's hiring.

Security leadership

Christopher Porter

Senior Vice President and Chief Information Security OfficerHiring influence: HighStated publiclyHigh confidence

As the SVP and Chief Information Security Officer, he owns the security strategy and budget for the organization.

Public profile Source

Steve Narducci

Vice President - Information SecurityHiring influence: ModerateInferredHigh confidence

Directs information security operations and strategy under the CISO.

Public profile Source

Bruce Lee

Executive Vice President and Head of Operations and TechnologyHiring influence: HighStated publiclyHigh confidence

As Head of Operations and Technology, the CISO typically reports into this leadership pillar.

Public profile Source

People are recorded only from public sources. Where a role in the hierarchy is inferred rather than stated, CLI labels it so you can weigh it yourself.

Approach

Open any live role below for its full approach path: the likely hiring owner, the decision circle around them, and the strongest route in.

Security organization

Estimated team size250–500 peopleModerate confidence

The CISO reports to the EVP and Head of Operations and Technology, aligning security with broader enterprise operations and IT. The organization utilizes a traditional hierarchical structure with VP-level leads for specific domains like security operations and risk.

Major functions

Identity and Access Management (IAM)Cybersecurity Operations and Incident ResponseCloud Security and Infrastructure ArchitectureSecurity Risk and GovernanceThird-Party Risk Management (TPRM)

Maturity indicators

Maintains a dedicated C-suite CISO role reported in corporate governance disclosures.
Publishes formal vendor risk notifications and maintains a centralized security reporting structure.
Operates under heavy FHFA regulatory oversight requiring mature risk management frameworks.

As a Government-Sponsored Enterprise (GSE), Fannie Mae maintains a high-maturity security posture dictated by federal financial regulations and the FHFA.

Organization figures are CLI estimates, not disclosures. High confidence

Security events

Nov 2023
Fannie Mae notifies individuals of data breach at vendor Perry Johnson & Associates
Security incidentHigh confidence
Fannie Mae issued a notice regarding a data breach at its vendor, Perry Johnson & Associates (PJ&A), which affected the personal information of certain individuals.
Source

Technologies observed

AWSCloud2 postings

CyberArkIdentity1 posting

MITRE ATT&CKFramework1 posting

NIST CSFFramework1 posting

Extracted verbatim from this employer's security postings. Absence from this list does not mean the tool is not in use.

Open cyber leadership roles

Vice President, Cyber Defense

Fannie Mae · Financial Services

Washington, DC · Hybrid

$250,000 – $350,000 base, disclosed

VP-equivalent

CLI Career Level

Opportunity

Strong · Last verified 1 hour ago

Cyber Leadership Index compiles these dossiers from public sources and the employer's own postings. Inferred figures are labelled with a confidence level; anything CLI cannot establish is shown as unknown rather than estimated. Last refreshed September 30, 2026.