Senior Director – Security Posture & Exposure Management

Eli Lilly and Company

. Set and own the technical strategy, architecture, operating model, roadmap, and outcomes for end-to-end enterprise vulnerability management .

Posted 10/21/2026full-timeRemote • United StatesSenior💰 $159,000 - $257,400 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in enterprise vulnerability management, including technical strategy, architecture, and risk-based prioritization. Proven ability to lead security functions, manage teams, and integrate application security practices into organizational processes.

Highest-signal resume keywords

Vulnerability ManagementApplication SecurityOffensive SecurityRisk-Based PrioritizationSecurity Operations Leadership

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cyber SecurityVulnerability Management ExperienceSAST/DAST FamiliaritySecurity Tooling DesignData Pipeline AutomationMetrics AnalysisRemediation SLA EstablishmentHybrid Cloud SecurityOn-Premises SecurityRed Team Practice

Soft Skills

Excellent CommunicationInfluence SkillsLeadership

Certifications & Qualifications

Bachelor’s Degree in Cyber SecurityBachelor’s Degree in Computer ScienceBachelor’s Degree in Information Technology

Industry Keywords

Enterprise ScaleSecurity OperationsRisk AcceptanceThreat IntelligenceExposure ReportingExecutive ReportingAccountability ModelsBudget ManagementVendor RelationshipsOT Experience

Tech Stack

Tools & technologies

CloudCyber Security

About the role

Key responsibilities & impact

Set and own the technical strategy, architecture, operating model, roadmap, and outcomes for end-to-end enterprise vulnerability management
Lead, develop, and hold accountable leaders and teams across vulnerability management, application security, offensive security, advanced discovery, validation and prioritization, and exposure reporting
Own the technical direction of the enterprise scanning estate, including coverage architecture, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integrations
Serve as the senior technical escalation point for disputed findings, severity, exploitability, false positives, and exceptions
Establish risk-based prioritization standards using severity, exploitability, threat intelligence, asset criticality, and exposure context
Define and enforce remediation SLAs, exception and escalation paths, and accountability models
Oversee the application security program and integrate its findings into enterprise prioritization, SLAs, and burndown reporting
Oversee offensive security and advanced vulnerability discovery, including scope, rules of engagement, and systemic remediation
Own exposure reporting and burndown, including executive reporting, technology-owner scorecards, trend analysis, data pipelines, and metrics
Document mitigations and manage risk acceptance where residual exposure cannot be eliminated
Partner with Security Operations, Incident Response, and threat intelligence on actively exploited weaknesses
Manage budget, vendor relationships, headcount, contract resources, and offshore resources

Requirements

What you’ll need

High School Diploma with 4+ years of experience in Cyber Security, Information Technology, or a related field
10+ years of hands-on professional experience in cybersecurity, primarily in vulnerability management, security operations, or offensive security
5+ years leading a security function
3+ years managing people leaders
Hands-on vulnerability management experience across hybrid cloud and on-premises environments
Experience leading a vulnerability management or security operations organization at enterprise scale, including leading other people leaders
Familiarity with application security practices, including SAST/DAST, software composition, and secure development
Ability to build risk-based prioritization trusted by technology teams
Experience establishing remediation SLAs and accountability models
Working knowledge of offensive security and red team practice
Experience designing or re-architecting security tooling, automation, and data pipelines
Strong data and metrics skills
Excellent communication and influence skills
Bachelor’s Degree in Cyber Security, Computer Science, or Information Technology preferred
OT or regulated lab experience is a plus

Benefits

Comp & perks

Company bonus depending partly on company and individual performance
Company-sponsored 401(k)
Pension
Vacation benefits
Medical, dental, vision, and prescription drug benefits
Healthcare and/or dependent day care flexible spending accounts
Life insurance and death benefits
Time off and leave of absence benefits
Employee assistance program
Fitness benefits
Employee clubs and activities