Senior Director – Security Posture & Exposure Management

Eli Lilly and Company

. Lead the organization responsible for finding, prioritizing, and driving closure of security weaknesses across Lilly’s technology estate .

Posted 10/20/2026full-timeRemote • United StatesSenior💰 $159,000 - $257,400 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in vulnerability management and offensive security, with a strong focus on risk-based prioritization, remediation strategies, and enterprise-scale leadership. Proven ability to manage teams, establish accountability models, and communicate effectively with technology stakeholders.

Highest-signal resume keywords

Vulnerability ManagementOffensive SecurityApplication Security PracticesRisk-Based PrioritizationData Pipeline Design

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cyber SecurityExploitability AnalysisAttack Surface ManagementRemediation OperationsSAST/DASTSecurity Tooling DesignAutomationMetrics AnalysisHybrid Cloud EnvironmentsOn-Premises Environments

Soft Skills

Excellent CommunicationInfluence SkillsTeam Leadership

Tools & Technologies

Scanning PlatformsSecurity Operations ToolsData Pipelines

Certifications & Qualifications

Bachelor’s Degree in Cyber SecurityBachelor’s Degree in Computer ScienceBachelor’s Degree in Information Technology

Industry Keywords

Enterprise Vulnerability ManagementSecurity OperationsRisk AcceptanceThreat IntelligenceExecutive Reporting

Tech Stack

Tools & technologies

CloudCyber Security

About the role

Key responsibilities & impact

Lead the organization responsible for finding, prioritizing, and driving closure of security weaknesses across Lilly’s technology estate
Set and own the technical strategy, architecture, operating model, roadmap, and outcomes for enterprise vulnerability management
Lead, develop, and hold accountable teams across vulnerability management, application security, offensive security, advanced discovery, prioritization, and exposure reporting
Own the enterprise scanning estate, including coverage architecture, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integrations
Serve as senior technical escalation point for disputed findings, severity, exploitability, false positives, and exceptions
Establish risk-based prioritization standards using severity, exploitability, threat intelligence, asset criticality, and exposure context
Define and enforce remediation SLAs, exception and escalation paths, and accountability models
Oversee application security and offensive security programs and connect findings to enterprise prioritization, SLAs, and burndown reporting
Own exposure reporting and burndown, including executive reporting, scorecards, trend analysis, data pipelines, and metrics
Document mitigations and manage risk acceptance for residual exposure
Partner with Security Operations, Incident Response, and threat intelligence teams
Manage budget, vendor relationships, headcount, contract resources, and offshore resources

Requirements

What you’ll need

High School Diploma with 4+ years of experience in Cyber Security, Information Technology, or a related field
10+ years of hands-on professional experience in cybersecurity, primarily in vulnerability management, security operations, or offensive security
5+ years leading a security function
3+ years managing people leaders
Hands-on vulnerability management experience across hybrid cloud and on-premises environments, including scanning platforms, exploitability analysis, attack surface management, and remediation operations
Enterprise-scale leadership experience, including leading other people leaders
Working familiarity with application security practices, including SAST/DAST, software composition, and secure development
Ability to build risk-based prioritization trusted by technology teams
Experience establishing remediation SLAs and accountability models
Working knowledge of offensive security and red team practices
Experience designing or re-architecting security tooling, automation, and data pipelines
Strong data and metrics skills
Excellent communication and influence skills
Bachelor’s Degree in Cyber Security, Computer Science, Information Technology, or a related field is preferred

Benefits

Comp & perks

Company bonus, depending in part on company and individual performance
Company-sponsored 401(k)
Pension
Vacation benefits
Medical, dental, vision, and prescription drug benefits
Flexible benefits, including healthcare and/or dependent day care flexible spending accounts
Life insurance and death benefits
Time off and leave of absence benefits
Well-being benefits, including employee assistance program, fitness benefits, and employee clubs and activities
Employee resource groups and support networks