Senior Director – Security Posture & Exposure Management
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Senior security leader overseeing Lilly’s enterprise vulnerability management and exposure reduction. Leading teams, tooling, prioritization, remediation, and executive risk reporting for a global medicines company.
Responsibilities:
- Own Lilly’s enterprise vulnerability management program and security posture and exposure management function
- Set the technical strategy, architecture, operating model, roadmap, and outcomes for end-to-end vulnerability management
- Lead and develop leaders and teams across vulnerability management, application security, offensive security, advanced discovery, validation and prioritization, and exposure reporting
- Mature the function from a scanning operation into a risk-based vulnerability management capability
- Own the enterprise scanning estate, including coverage architecture, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integrations
- Serve as the senior technical escalation point for disputed findings, severity, exploitability, false positives, and exceptions
- Establish risk-based prioritization using severity, exploitability, threat intelligence, asset criticality, and exposure context
- Define and enforce remediation SLAs, exception and escalation paths, and accountability models
- Oversee application security and integrate application findings into common prioritization, SLAs, and burndown reporting
- Oversee offensive security and advanced vulnerability discovery, including scope and rules of engagement
- Own executive exposure reporting, technology-owner scorecards, trend analysis, data pipelines, and metrics
- Document mitigations and manage risk acceptance for residual exposure
- Partner with Security Operations, Incident Response, and threat intelligence teams
- Manage budget, vendors, headcount, contract resources, and offshore resources
Requirements:
- High School Diploma with 4+ years of experience in Cyber Security, Information Technology, or a related field
- 10+ years of hands-on professional experience in cybersecurity, primarily in vulnerability management, security operations, or offensive security, including 5+ years leading a security function
- 3+ years managing people leaders
- Hands-on vulnerability management experience across hybrid cloud and on-premises environments, including scanning platforms, exploitability analysis, attack surface management, and remediation operations
- Experience leading a vulnerability management or security operations organization at enterprise scale, including leading other people leaders
- Working familiarity with application security practices, including SAST/DAST, software composition, and secure development
- Ability to build risk-based prioritization trusted by technology teams
- Experience establishing remediation SLAs and accountability models
- Working knowledge of offensive security and red team practices
- Experience designing or re-architecting security tooling, automation, and data pipelines
- Strong data and metrics skills
- Excellent communication and influence skills
- OT or regulated lab experience is a plus
- Bachelor’s Degree in Cyber Security, Computer Science, Information Technology, or a related field is preferred
Benefits:
- Company bonus based partly on company and individual performance
- Company-sponsored 401(k)
- Pension
- Vacation benefits
- Medical, dental, vision, and prescription drug benefits
- Flexible benefits, including healthcare and dependent day care flexible spending accounts
- Life insurance and death benefits
- Time off and leave of absence benefits
- Well-being benefits, including employee assistance program, fitness benefits, and employee clubs and activities
- Employee resource groups and support networks
Similar Jobs
Infrastructure Security Vulnerability Engineer
Infrastructure Security Vulnerability Engineer reducing vulnerability risk across Avaya’s FedRAMP cloud environments. Coordinating remediation, compliance, reporting, and security improvements for federal-government operations.
Cybersecurity Specialist
Cybersecurity Specialist monitoring alerts and investigating incidents for CyberMaxx’s managed detection and response cybersecurity services. Supporting threat detection, customer response, and SOC operations.
Senior Information Security Engineer
Information Security Engineer monitoring threats and vulnerabilities for First American's title insurance, settlement, and property technology solutions. Operating security tools, incident response, risk analysis, and recovery processes.
Senior Information Security Engineer
Senior Cloud Security Engineer operating CNAPP platforms and securing cloud environments at First American India. Driving cloud risk remediation across infrastructure, applications, Kubernetes, and DevSecOps teams.
Senior Security Consultant
Senior Security Consultant designing low-voltage and communication systems for ARES data center infrastructure projects. Coordinating BIM, documentation, budgets, and project stakeholders.
Red Team Security Engineer
Red Team Security Engineer validating vulnerabilities, attack paths, and AI-enabled systems. Strengthening defenses for Backblaze’s open cloud storage platform through offensive and purple-team exercises.
Online Visiting Professor – Cybersecurity
Online Visiting Professor teaching undergraduate and graduate cybersecurity courses for DeVry University. Developing course materials, assessing students, and integrating responsible AI into instruction.
Information Security Specialist
Information Security Specialist protecting Farmers’ global insurance systems and data from cybersecurity risks. Assessing vulnerabilities, managing incidents, strengthening controls, and advising technology teams.
Strategic Solution Sales Executive – Cybersecurity
Strategic cybersecurity sales executive driving OpenText solution growth across U.S. enterprise accounts. Leading complex solution sales cycles and executive stakeholder engagements.
Security Cooperation Financial Management Specialist – Lead
Financial management specialist supporting U.S. Combatant Commands with DAI accounting, audit readiness, and process improvement. Remote role for Koniag Government Services’ federal defense operations.
Manager, Application Security – SOX IT, Oracle Fusion
Application Security Manager securing Oracle Fusion, EPM, and OIC environments for Paramount’s global media and entertainment company. Leading SOX compliance, identity governance, and segregation-of-duties controls.
Senior Security Engineer, Threat Detection and Response
Senior Security Engineer investigating threats, building detection automation, and improving incident response. Supporting U.S.-based corporate and production environments through security engineering and threat hunting.
Staff Security Engineer, Security Enablement
Staff Security Engineer designing DoorDash’s global physical and cloud security systems. Leading multi-team programs, AWS infrastructure, security integrations, and enterprise risk reduction.
Cybersecurity Intern
Cybersecurity Intern gaining hands-on experience in security operations, vulnerability management, and incident response. Supporting cybersecurity projects at global electronics manufacturer Kimball Electronics.
Ethical Hacker – Penetration Tester
Pentester conduzindo avaliações ofensivas em infraestrutura, aplicações, redes Wi-Fi e soluções de IA. Grupo Trade Technology oferece tecnologia, segurança e transformação digital.
Staff Mobile Security Engineer
Staff Mobile Security Engineer securing MrBeast’s large-scale mobile media, gaming, and fintech experiences. Owning device integrity, fraud defense, and security engineering team growth.
Security Engineer
Security Engineer investigating high-impact incidents and building SIEM-based detections for Expleo, a global engineering and technology services provider. Remote role for candidates living in Portugal.
Information Security Officer
Information Security Officer maintaining Finom’s certified ISMS, risk framework, audits, and supplier assessments. Supporting compliance for the company’s European B2B financial platform.
Information Security Officer
Information Security Officer maintaining ISMS, audits, and ICT risk management for Finom’s European financial platform. Improving compliance through supplier assessments, reporting, automation, and regulatory monitoring.
Information Security Officer
Information Security Officer managing ISMS, audits, vendor assessments and ICT risk for Finom’s European financial platform. Reporting to the CISO and improving compliance through automation.