Key responsibilities: Set the technical strategy, architecture, and operating model for end-to-end vulnerability management; lead and develop the leaders and teams in the function; set prioritization standards and remediation SLAs; drive accountability with technology owners; and report posture and remediation progress to senior leadership.

Collaboration: This role works directly with Security Architecture & Engineering leadership, Security Operations and Incident Response, Tech at

Lilly platform and application owners, Risk & Compliance, internal audit, and external scanning and testing vendors.

What You’ll Be Doing

As Head of Security Posture & Exposure Management on the Security Architecture & Engineering team, you will lead the organization responsible for finding, prioritizing, and driving closure of security weaknesses across Lilly’s technology estate.

The organization spans vulnerability management and the enterprise scanning estate, application security, offensive security and advanced vulnerability discovery, validation and prioritization, and exposure reporting and burndown, each with existing leaders and teams. You will mature the function from a scanning operation into a risk-based vulnerability management capability, including the tooling architecture, automation, and data model behind it, and you will understand the estate, the tools, and the findings well enough to make technical decisions directly.

How You’ll Succeed

Technical depth: You will have the depth to distinguish real exposure from scanner noise, evaluate a prioritization model on its merits, and identify coverage gaps, and to direct the team to a better approach when needed.

Leading an organization: You will lead through directors and leads, setting clear priorities, developing talent, and staying close enough to the work to know when it is off track.

Prioritization: You will build the validation, context, and prioritization that lets the enterprise focus on the findings that create real risk rather than the full list.

Accountability: You will establish SLAs, escalation paths, and reporting that make remediation ownership visible to technology leaders and their management.

Tooling and operations: You will own the architecture of the scanning estate, discovery tooling, and reporting pipeline: reliable coverage, trustworthy data, and automation that removes manual work.

Key Responsibilities:

• Set and own the technical strategy, architecture, operating model, roadmap, and outcomes for end-to-end enterprise vulnerability management across cloud, on-premises infrastructure, applications, endpoints, and OT/lab environments.

• Lead, develop, and hold accountable the leaders and teams across vulnerability management, application security, offensive security and advanced discovery, validation and prioritization, and exposure reporting and burndown.

• Own the technical direction of the enterprise scanning estate: coverage architecture, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integration with ticketing, CMDB, and reporting.

• Serve as the senior technical escalation point for the organization-adjudicating disputed findings, severity and exploitability, false positives, and exceptions.

• Establish risk-based prioritization standards that combine severity, exploitability, threat intelligence, asset criticality, and exposure context, and ensure findings are validated before they consume remediation capacity.

• Define and enforce remediation SLAs, exception and escalation paths, and the accountability model that places ownership with technology owners and their leadership.

• Oversee the application security program as part of end-to-end vulnerability management, partnering with its leadership to connect application findings to the same prioritization, SLAs, and burndown reporting as infrastructure and cloud exposure.

• Oversee the offensive security and advanced vulnerability discovery program, including scope, rules of engagement, and conversion of findings into systemic fixes rather than one-off tickets.

• Own exposure reporting and burndown: executive reporting, technology-owner scorecards, trend analysis, and the underlying data pipeline and metrics.

• Document mitigations and manage risk acceptance where residual exposure cannot be eliminated, framing decisions accurately and securing approvals that hold up to audit.

• Partner with Security Operations, Incident Response, and threat intelligence to prioritize actively exploited weaknesses and feed lessons from incidents back into coverage and prioritization.

• Manage budget, vendor relationships, and headcount for the function, including contract and offshore resources., Lead biopharma business development across the US West Coast and Central States, acquiring pharmaceutical and biotechnology customers and expanding strategic accounts. Build and manage Salesforce pipeline, develop proposals, negotiate agreements, and close projects involving genomic assays, biomarker discovery, clinical trial assays, precision medicine, and companion diagnostics. Collaborate with scientific, commercial, and operational teams to shape customer solutions. Travel domestically and internationally approximately 30% of the time.

Experience: Deep, hands-on vulnerability management experience combined with proven leadership of a multi-team function at enterprise scale, including leading leaders. Background is open-security operations, vulnerability management, offensive security, or security engineering are all relevant paths, provided the depth supports sound judgment on findings, scan configuration, and prioritization, * Hands-on vulnerability management experience-scanning platforms, exploitability analysis, attack surface management, and remediation operations across hybrid cloud and on-premises environments; OT or regulated lab experience is a plus.

• Experience leading a vulnerability management or security operations organization at enterprise scale, including leading other people leaders.

• Working familiarity with application security practice-SAST/DAST, software composition, and secure development-sufficient to integrate it into the enterprise vulnerability management program.

• Demonstrated ability to build risk-based prioritization that technology teams trust.

• Experience establishing remediation SLAs and accountability models that measurably improved remediation outcomes.

• Working knowledge of offensive security and red team practice sufficient to direct the program, judge the value of its findings, and translate them into systemic fixes.

• Experience designing or re-architecting security tooling, automation, and data pipelines.

• Strong data and metrics skills: defining meaningful measures, validating data quality, and presenting exposure and risk decisions in a form that withstands executive and audit review.

• Excellent communication and influence skills, including driving action from technology leaders outside your reporting line., * High School Diploma with 4+ years of experience in Cyber Security, Information Technology, or a related field.

• 10+ years of hands-on professional experience in cybersecurity, primarily in vulnerability management, security operations, or offensive security, including 5+ years leading a security function.
• 3+ years managing people leaders.

Preferences:

• Bachelor’s Degree (example in Cyber Security, Computer Science, Information Technology)

Leads Lilly’s enterprise security posture and exposure management organization. Owns vulnerability management strategy, scanning architecture, application security integration, offensive security oversight, risk-based prioritization, remediation SLAs, exposure reporting, tooling, automation, vendors, budget, and executive accountability. The role requires deep hands-on cybersecurity expertise and experience leading leaders across enterprise-scale vulnerability management or security operations. The summary above was generated by AI, Actual compensation will depend on a candidate’s education, experience, skills, and geographic location. The anticipated wage for this position is $159,000 - $257,400

Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance). In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities).Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly’s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees.

WeAreLilly, An Hour Ago

Remote or Hybrid 174K-198K Annually Senior level 174K-198K Annually Senior level Artificial Intelligence * Cloud * HR Tech * Information Technology * Productivity * Software * Automation Develops new business within major Health Life Sciences accounts, manages executive customer relationships, leads cross-functional virtual teams, aligns ServiceNow solutions to strategic outcomes, expands worldwide account resources, builds client relationships, and achieves license, renewal, and professional services revenue targets. Top Skills: Artificial IntelligenceCustomer Service ManagementIt Operations ManagementIt Service ManagementSecurity OperationsServicenow SOPHiA GENETICS, 140K-195K Annually Entry level 140K-195K Annually Entry level Cloud * Computer Vision * Information Technology * Sales * Security * Cybersecurity Lead incident response consulting engagements, including client scoping, forensic and malware investigations, threat hunting, remediation planning, and executive communications. Coach junior analysts conducting host and network forensics across Windows, macOS, and Linux. Develop recommendations to improve clients’ security posture, produce reports for stakeholders and legal counsel, contribute thought leadership, and travel up to 30% as needed. Top Skills: Artificial IntelligenceAWSBro/ZeekGoogle Cloud PlatformLinuxmacOSMalware AnalysisAzureNetwork ProtocolsSuricataWindows

What you need to know about the Colorado Tech Scene

With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation.

Key Facts About Colorado Tech

• Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
• Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
• Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
• Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
• Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
• Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute

At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work-but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us.