Senior Director – Security Posture & Exposure Management

Eli Lilly and Company

. Own Lilly’s enterprise vulnerability management program and security posture and exposure management function .

Posted 10/21/2026full-timeRemote • United StatesSenior💰 $159,000 - $257,400 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in vulnerability management and security operations, with a strong focus on risk-based prioritization, remediation strategies, and team leadership. Proficient in managing enterprise-scale security functions and integrating application security practices into vulnerability management processes.

Highest-signal resume keywords

Vulnerability ManagementSecurity Operations LeadershipRisk-Based PrioritizationApplication Security PracticesData and Metrics Analysis

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cyber SecurityVulnerability ManagementExploitability AnalysisAttack Surface ManagementRemediation OperationsSAST/DASTSecurity Tooling DesignAutomationData PipelinesMetrics Development

Soft Skills

Excellent CommunicationInfluence SkillsTeam Leadership

Tools & Technologies

Scanning PlatformsHybrid Cloud EnvironmentsOn-Premises Environments

Certifications & Qualifications

Bachelor’s Degree in Cyber SecurityBachelor’s Degree in Computer ScienceBachelor’s Degree in Information Technology

Industry Keywords

Offensive SecurityRed Team PracticesRisk AcceptanceExecutive Exposure ReportingOT Experience

Tech Stack

Tools & technologies

CloudCyber Security

About the role

Key responsibilities & impact

Own Lilly’s enterprise vulnerability management program and security posture and exposure management function
Set the technical strategy, architecture, operating model, roadmap, and outcomes for end-to-end vulnerability management
Lead and develop leaders and teams across vulnerability management, application security, offensive security, advanced discovery, validation and prioritization, and exposure reporting
Mature the function from a scanning operation into a risk-based vulnerability management capability
Own the enterprise scanning estate, including coverage architecture, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integrations
Serve as the senior technical escalation point for disputed findings, severity, exploitability, false positives, and exceptions
Establish risk-based prioritization using severity, exploitability, threat intelligence, asset criticality, and exposure context
Define and enforce remediation SLAs, exception and escalation paths, and accountability models
Oversee application security and integrate application findings into common prioritization, SLAs, and burndown reporting
Oversee offensive security and advanced vulnerability discovery, including scope and rules of engagement
Own executive exposure reporting, technology-owner scorecards, trend analysis, data pipelines, and metrics
Document mitigations and manage risk acceptance for residual exposure
Partner with Security Operations, Incident Response, and threat intelligence teams
Manage budget, vendors, headcount, contract resources, and offshore resources

Requirements

What you’ll need

High School Diploma with 4+ years of experience in Cyber Security, Information Technology, or a related field
10+ years of hands-on professional experience in cybersecurity, primarily in vulnerability management, security operations, or offensive security, including 5+ years leading a security function
3+ years managing people leaders
Hands-on vulnerability management experience across hybrid cloud and on-premises environments, including scanning platforms, exploitability analysis, attack surface management, and remediation operations
Experience leading a vulnerability management or security operations organization at enterprise scale, including leading other people leaders
Working familiarity with application security practices, including SAST/DAST, software composition, and secure development
Ability to build risk-based prioritization trusted by technology teams
Experience establishing remediation SLAs and accountability models
Working knowledge of offensive security and red team practices
Experience designing or re-architecting security tooling, automation, and data pipelines
Strong data and metrics skills
Excellent communication and influence skills
OT or regulated lab experience is a plus
Bachelor’s Degree in Cyber Security, Computer Science, Information Technology, or a related field is preferred

Benefits

Comp & perks

Company bonus based partly on company and individual performance
Company-sponsored 401(k)
Pension
Vacation benefits
Medical, dental, vision, and prescription drug benefits
Flexible benefits, including healthcare and dependent day care flexible spending accounts
Life insurance and death benefits
Time off and leave of absence benefits
Well-being benefits, including employee assistance program, fitness benefits, and employee clubs and activities
Employee resource groups and support networks