Senior Director - Security Posture & Exposure Management

Lilly • Indianapolis, IN

3d • $159,000 - $257,400

About The Position

As Head of Security Posture & Exposure Management on Lilly’s Security Architecture & Engineering team, this technical leader owns the enterprise vulnerability management program and the organization responsible for finding, validating, prioritizing, and driving closure of security weaknesses across Lilly’s technology estate. The role spans vulnerability management and enterprise scanning, application security, offensive security and advanced vulnerability discovery, and exposure reporting and burndown. It will mature the function from a scanning operation into a risk-based vulnerability management capability, including its tooling architecture, automation, data model, and operating model.

The position combines hands-on technical judgment with leadership through directors and other leaders. The leader must understand the estate, tools, and findings well enough to distinguish genuine exposure from scanner noise, evaluate prioritization methods, identify coverage gaps, and direct technical improvements. The role works with Security Architecture & Engineering leadership, Security Operations and Incident Response, platform and application owners, Risk & Compliance, internal audit, and external scanning and testing vendors. It also manages the function’s budget, vendors, headcount, and contract and offshore resources.

Requirements

• High school diploma and 4+ years of experience in cybersecurity, information technology, or a related field.
• 10+ years of hands-on professional cybersecurity experience, primarily in vulnerability management, security operations, or offensive security, including 5+ years leading a security function.
• 3+ years managing people leaders.
• Hands-on vulnerability management experience with scanning platforms, exploitability analysis, attack surface management, and remediation operations across hybrid cloud and on-premises environments.
• Experience leading a vulnerability management or security operations organization at enterprise scale, including leading other people leaders.
• Working familiarity with application security practices, including SAST/DAST, software composition, and secure development, sufficient to integrate them into an enterprise vulnerability management program.
• Demonstrated ability to build risk-based prioritization trusted by technology teams.
• Experience establishing remediation SLAs and accountability models that measurably improved remediation outcomes.
• Working knowledge of offensive security and red team practice sufficient to direct the program, assess findings, and translate them into systemic fixes.
• Experience designing or re-architecting security tooling, automation, and data pipelines.
• Strong data and metrics skills, including defining meaningful measures, validating data quality, and presenting exposure and risk decisions for executive and audit review.
• Excellent communication and influence skills, including driving action from technology leaders outside the reporting line.

Nice To Haves

• Bachelor’s degree, for example in Cyber Security, Computer Science, or Information Technology.
• OT or regulated lab experience.

Responsibilities

• Set and own the technical strategy, architecture, operating model, roadmap, and outcomes for end-to-end enterprise vulnerability management across cloud, on-premises infrastructure, applications, endpoints, and OT/lab environments.
• Lead, develop, and hold accountable teams and leaders across vulnerability management, application security, offensive security and advanced discovery, validation and prioritization, and exposure reporting and burndown.
• Own the technical direction of the enterprise scanning estate, including coverage architecture, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integrations with ticketing, CMDB, and reporting.
• Serve as the senior technical escalation point for adjudicating disputed findings, severity and exploitability, false positives, and exceptions.
• Establish risk-based prioritization standards combining severity, exploitability, threat intelligence, asset criticality, and exposure context, and ensure findings are validated before using remediation capacity.
• Define and enforce remediation SLAs, exception and escalation paths, and accountability models that place ownership with technology owners and their leadership.
• Oversee application security and connect application findings to enterprise vulnerability management prioritization, SLAs, and burndown reporting.
• Oversee offensive security and advanced vulnerability discovery, including scope, rules of engagement, and converting findings into systemic fixes.
• Own exposure reporting and burndown, including executive reporting, technology-owner scorecards, trend analysis, and the underlying data pipeline and metrics.
• Document mitigations and manage risk acceptance when residual exposure cannot be eliminated, accurately framing decisions and securing approvals that withstand audit.
• Partner with Security Operations, Incident Response, and threat intelligence to prioritize actively exploited weaknesses and incorporate incident lessons into coverage and prioritization.
• Manage the function’s budget, vendor relationships, and headcount, including contract and offshore resources.

Benefits

• Company bonus, depending in part on company and individual performance.
• Company-sponsored 401(k).
• Pension.
• Vacation benefits.
• Medical, dental, vision, and prescription drug benefits.
• Flexible benefits, including healthcare and/or dependent day care flexible spending accounts.
• Life insurance and death benefits.
• Certain time off and leave of absence benefits.
• Well-being benefits, including employee assistance program, fitness benefits, and employee clubs and activities.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: High school or GED