Principal Security Architect

Lilly•Indianapolis, IN

2d•$163,500 - $297,000•Onsite

About The Position

As Principal Security Architect on the Security Architecture & Engineering team, you will be the dedicated security architect for a major strategic program built primarily on AWS, with workloads handling trade secrets and highly sensitive intellectual property. You will own its security architecture across cloud platforms, data flows, identity, and third-party integrations, and lead architecture reviews, threat modeling, and risk assessments. You will develop reference architectures and design patterns that scale across the program, provide technical direction to engineers supporting the work, and ensure technology is deployed securely and in alignment with enterprise security standards.

Requirements

Security depth sufficient to make sound judgment calls on real designs. Backgrounds vary and all of the following are relevant paths: building and operating secure systems, security engineering, incident response, penetration testing, or security architecture.
Depth in at least one major cloud platform (AWS, Azure, or GCP), covering identity and access management, network architecture, workload protection, encryption and key management, and cloud security posture management, with the ability to apply that depth across additional providers.
Demonstrated experience securing workloads handling trade secrets or highly sensitive intellectual property, including segmentation, access boundaries, and egress controls.
Strong understanding of secure application development and the secure software development lifecycle, including threat mitigation techniques.
Strong experience in threat analysis and modeling, and a solid understanding of cybersecurity engineering and operations.
Exceptional critical thinking and analytical reasoning, with proven ability to define and influence security strategy while also guiding tactical work.
Ability to translate technical risk into clear business language and to document risk decisions in a form that holds up to audit and executive review.
Excellent communication and presentation skills, with the ability to adapt messaging for technical and non-technical audiences.
Experience developing and documenting architecture references, security guidelines, and standards, and mentoring more junior architects and engineers.
High School Diploma/equivalent with 4+ years of experience in Cyber Security, Information Technology, or a related field.
8+ years of professional experience across security, software engineering, cloud engineering, or a combination, including hands-on cloud security work.
Qualified applicants must be authorized to work in the United States on a full-time basis. Lilly will not provide support for or sponsor work authorization or visas for this role, including but not limited to F-1 CPT, F-1 OPT, F-1 STEM OPT, J-1, H-1B, TN, O-1, E-3, H-1B1, or L-1.

Responsibilities

Own the security architecture and risk posture for an assigned strategic program spanning cloud platforms, data flows, identity, and third-party integrations.
Conduct architecture and design reviews, threat modeling, and risk assessments across cloud platforms, application components, identity, and integrations.
Design and review controls for workloads handling trade secrets and highly sensitive intellectual property, covering segmentation, access boundaries, egress controls, encryption and key management, and monitoring.
Establish secure cloud architecture patterns and extend them consistently across the cloud platforms in scope.
Apply threat modeling frameworks alongside recognized industry security standards, frameworks, and best practices when evaluating designs and documenting technical guidance.
Perform threat analysis and modeling to enable business and technical partners to deliver secure solutions integrated with the secure development and operations lifecycle.
Drive risk acceptance where residual risk cannot be eliminated, framing the decision accurately, securing approvals, and documenting the outcome.
Develop reference architectures, design patterns, and security guidance from recurring requirements, and partner across Security Architecture & Engineering to bring the right expertise into engagements.
Provide technical leadership and mentorship to architects and engineers supporting the program.

Benefits

company bonus
company-sponsored 401(k)
pension
vacation benefits
medical benefits
dental benefits
vision benefits
prescription drug benefits
flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts)
life insurance
death benefits
certain time off and leave of absence benefits
well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities)