Senior Director - Security Posture & Exposure Management

At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us. 

Senior Director - Security Posture & Exposure Management

Role summary: Security Architecture & Engineering needs a technical leader to own Lilly’s enterprise vulnerability management program.

This is a hands-on technical leader who can run an organization and owns end-to-end vulnerability management: finding weaknesses, prioritizing them, and getting them fixed. This person is accountable for how well Lilly understands and reduces its attack surface.

Experience: Deep, hands-on vulnerability management experience combined with proven leadership of a multi-team function at enterprise scale, including leading leaders. Background is open—security operations, vulnerability management, offensive security, or security engineering are all relevant paths, provided the depth supports sound judgment on findings, scan configuration, and prioritization

Key responsibilities: Set the technical strategy, architecture, and operating model for end-to-end vulnerability management; lead and develop the leaders and teams in the function; set prioritization standards and remediation SLAs; drive accountability with technology owners; and report posture and remediation progress to senior leadership.

Collaboration: This role works directly with Security Architecture & Engineering leadership, Security Operations and Incident Response, Tech at

Lilly platform and application owners, Risk & Compliance, internal audit, and external scanning and testing vendors.

What You’ll Be Doing

As Head of Security Posture & Exposure Management on the Security Architecture & Engineering team, you will lead the organization responsible for finding, prioritizing, and driving closure of security weaknesses across Lilly’s technology estate.

The organization spans vulnerability management and the enterprise scanning estate, application security, offensive security and advanced vulnerability discovery, validation and prioritization, and exposure reporting and burndown, each with existing leaders and teams. You will mature the function from a scanning operation into a risk-based vulnerability management capability, including the tooling architecture, automation, and data model behind it, and you will understand the estate, the tools, and the findings well enough to make technical decisions directly.

How You’ll Succeed

Technical depth: You will have the depth to distinguish real exposure from scanner noise, evaluate a prioritization model on its merits, and identify coverage gaps, and to direct the team to a better approach when needed.

Leading an organization: You will lead through directors and leads, setting clear priorities, developing talent, and staying close enough to the work to know when it is off track.

Prioritization: You will build the validation, context, and prioritization that lets the enterprise focus on the findings that create real risk rather than the full list.

Accountability: You will establish SLAs, escalation paths, and reporting that make remediation ownership visible to technology leaders and their management.

Tooling and operations: You will own the architecture of the scanning estate, discovery tooling, and reporting pipeline: reliable coverage, trustworthy data, and automation that removes manual work.

Key Responsibilities:

• Set and own the technical strategy, architecture, operating model, roadmap, and outcomes for end-to-end enterprise vulnerability management across cloud, on-premises infrastructure, applications, endpoints, and OT/lab environments.

• Lead, develop, and hold accountable the leaders and teams across vulnerability management, application security, offensive security and advanced discovery, validation and prioritization, and exposure reporting and burndown.

• Own the technical direction of the enterprise scanning estate: coverage architecture, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integration with ticketing, CMDB, and reporting.

• Serve as the senior technical escalation point for the organization—adjudicating disputed findings, severity and exploitability, false positives, and exceptions.

• Establish risk-based prioritization standards that combine severity, exploitability, threat intelligence, asset criticality, and exposure context, and ensure findings are validated before they consume remediation capacity.

• Define and enforce remediation SLAs, exception and escalation paths, and the accountability model that places ownership with technology owners and their leadership.

• Oversee the application security program as part of end-to-end vulnerability management, partnering with its leadership to connect application findings to the same prioritization, SLAs, and burndown reporting as infrastructure and cloud exposure.

• Oversee the offensive security and advanced vulnerability discovery program, including scope, rules of engagement, and conversion of findings into systemic fixes rather than one-off tickets.

• Own exposure reporting and burndown: executive reporting, technology-owner scorecards, trend analysis, and the underlying data pipeline and metrics.

• Document mitigations and manage risk acceptance where residual exposure cannot be eliminated, framing decisions accurately and securing approvals that hold up to audit.

• Partner with Security Operations, Incident Response, and threat intelligence to prioritize actively exploited weaknesses and feed lessons from incidents back into coverage and prioritization.

• Manage budget, vendor relationships, and headcount for the function, including contract and offshore resources.

What You Should Bring

• Hands-on vulnerability management experience—scanning platforms, exploitability analysis, attack surface management, and remediation operations across hybrid cloud and on-premises environments; OT or regulated lab experience is a plus.

• Experience leading a vulnerability management or security operations organization at enterprise scale, including leading other people leaders.

• Working familiarity with application security practice—SAST/DAST, software composition, and secure development—sufficient to integrate it into the enterprise vulnerability management program.

• Demonstrated ability to build risk-based prioritization that technology teams trust.

• Experience establishing remediation SLAs and accountability models that measurably improved remediation outcomes.

• Working knowledge of offensive security and red team practice sufficient to direct the program, judge the value of its findings, and translate them into systemic fixes.

• Experience designing or re-architecting security tooling, automation, and data pipelines.

• Strong data and metrics skills: defining meaningful measures, validating data quality, and presenting exposure and risk decisions in a form that withstands executive and audit review.

• Excellent communication and influence skills, including driving action from technology leaders outside your reporting line.

Basic Qualifications

• High School Diploma with 4+ years of experience in Cyber Security, Information Technology, or a related field.

• 10+ years of hands-on professional experience in cybersecurity, primarily in vulnerability management, security operations, or offensive security, including 5+ years leading a security function.
• 3+ years managing people leaders.

Preferences:

• Bachelor’s Degree (example in Cyber Security, Computer Science, Information Technology)

Lilly is dedicated to helping individuals with disabilities to actively engage in the workforce, ensuring equal opportunities when vying for positions. If you require accommodation to submit a resume for a position at Lilly, please complete the accommodation request form (https://careers.lilly.com/us/en/workplace-accommodation) for further assistance. Please note this is for individuals to request an accommodation as part of the application process and any other correspondence will not receive a response.

Lilly is proud to be an EEO Employer and does not discriminate on the basis of age, race, color, religion, gender identity, sex, gender expression, sexual orientation, genetic information, ancestry, national origin, protected veteran status, disability, or any other legally protected status.

Our employee resource groups (ERGs) offer strong support networks for their members and are open to all employees. Our current groups include: Africa, Middle East, Central Asia (AMECA), Black Employees at Lilly (BE@Lilly), Chinese Culture Network (CCN), EnAble, Evolve, Lilly Indian Network (LIN), Organization of Latinx at Lilly (OLA), Pride (LGBTQ+ Allies), Veterans Leadership Network (VLN) and Women’s Initiative for Leading at Lilly (WILL).

Actual compensation will depend on a candidate’s education, experience, skills, and geographic location.  The anticipated wage for this position is

Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance). In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities).Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly’s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees.

#WeAreLilly