Senior Director – Security Posture & Exposure Management

🔥 2 minutes ago

🇺🇸 United States – Remote

💵 $159k - $257.4k / year

⏰ Full Time

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Eli Lilly and Company

WebsiteLinkedInAll Job Openings

10,000+ employees

💊 Pharmaceuticals

🏥 Healthcare

🧬 Biotechnology

💰 $6.5M Post-IPO Debt - Eli Lilly on 2024-02

Pharmaceuticals • Healthcare • Biotechnology

Eli Lilly and Company is a multinational pharmaceutical company that researches, develops, manufactures, and markets prescription medicines across multiple therapeutic areas including diabetes, oncology, immunology, neuroscience, and pain. Headquartered in Indianapolis, Indiana, Lilly is known for its extensive R&D, clinical development, and global commercialization of biologic and small-molecule drugs. The company focuses on drug discovery, clinical trials, regulatory approvals, and large-scale pharmaceutical manufacturing and distribution.

📋 Description

• Own Lilly’s enterprise vulnerability management program and security posture and exposure management function • Set the technical strategy, architecture, operating model, roadmap, and outcomes for end-to-end vulnerability management • Lead and develop leaders and teams across vulnerability management, application security, offensive security, advanced discovery, validation and prioritization, and exposure reporting • Mature the function from a scanning operation into a risk-based vulnerability management capability • Own the enterprise scanning estate, including coverage architecture, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integrations • Serve as the senior technical escalation point for disputed findings, severity, exploitability, false positives, and exceptions • Establish risk-based prioritization using severity, exploitability, threat intelligence, asset criticality, and exposure context • Define and enforce remediation SLAs, exception and escalation paths, and accountability models • Oversee application security and integrate application findings into common prioritization, SLAs, and burndown reporting • Oversee offensive security and advanced vulnerability discovery, including scope and rules of engagement • Own executive exposure reporting, technology-owner scorecards, trend analysis, data pipelines, and metrics • Document mitigations and manage risk acceptance for residual exposure • Partner with Security Operations, Incident Response, and threat intelligence teams • Manage budget, vendors, headcount, contract resources, and offshore resources

🎯 Requirements

• High School Diploma with 4+ years of experience in Cyber Security, Information Technology, or a related field • 10+ years of hands-on professional experience in cybersecurity, primarily in vulnerability management, security operations, or offensive security, including 5+ years leading a security function • 3+ years managing people leaders • Hands-on vulnerability management experience across hybrid cloud and on-premises environments, including scanning platforms, exploitability analysis, attack surface management, and remediation operations • Experience leading a vulnerability management or security operations organization at enterprise scale, including leading other people leaders • Working familiarity with application security practices, including SAST/DAST, software composition, and secure development • Ability to build risk-based prioritization trusted by technology teams • Experience establishing remediation SLAs and accountability models • Working knowledge of offensive security and red team practices • Experience designing or re-architecting security tooling, automation, and data pipelines • Strong data and metrics skills • Excellent communication and influence skills • OT or regulated lab experience is a plus • Bachelor’s Degree in Cyber Security, Computer Science, Information Technology, or a related field is preferred

🏖️ Benefits

• Company bonus based partly on company and individual performance • Company-sponsored 401(k) • Pension • Vacation benefits • Medical, dental, vision, and prescription drug benefits • Flexible benefits, including healthcare and dependent day care flexible spending accounts • Life insurance and death benefits • Time off and leave of absence benefits • Well-being benefits, including employee assistance program, fitness benefits, and employee clubs and activities • Employee resource groups and support networks