Principal Security Architect
About the role? The posting includes a paragraph about Lilly and then "Principal Security Architect Main Attributes". The role summary etc.
We need to decide sections: About the role (maybe summary), Responsibilities, Qualifications, Skills, Benefits, Pay, Schedule.
We have content: Role summary, Key responsibilities, What You'll Be Doing, How You'll Succeed, Key Responsibilities (duplicate), What You Should Bring (skills/qualifications), Your Basic Qualifications (education/experience), compensation and benefits.
We need to extract substantive info.
Let's extract:
About the role: The initial paragraph about Lilly and the role description: "At Lilly, the work is demanding because patients are waiting...". Also "Principal Security Architect Main Attributes Role summary: Security Architecture & Engineering needs a senior architect to serve as the dedicated security architect for a major strategic program. The program is cloud-heavy, built primarily on AWS with additional cloud platforms in scope, and its workloads handle trade secrets and highly sensitive intellectual property. This person owns the security architecture end to end and is the definitive technical voice on cloud and application security for the program."
We can combine that into About the role.
Responsibilities: Many bullet-like sentences: Own the security architecture and risk posture for the assigned program; lead architecture reviews, threat modeling, and risk assessments; drive risk acceptance where residual risk remains; develop reference architectures, design patterns, and security guidance from recurring requirements. Also: "You will own its security architecture across cloud platforms, data flows, identity, and third-party integrations, and lead architecture reviews, threat modeling, and risk assessments. You will develop reference architectures and design patterns that scale across the program, provide technical direction to engineers supporting the work, and ensure technology is deployed securely and in alignment with enterprise security standards." Also the list under "Key Responsibilities" (multiple lines). We'll consolidate into a - .
Qualifications: "Your Basic Qualifications High School Diploma/equivalent with 4+ years of experience in Cyber Security, Information Technology, or a related field. 8+ years of professional experience across security, software engineering, cloud engineering, or a combination, including hands-on cloud security work. Qualified applicants must be authorized to work in the United States on a full-time basis. Lilly will not provide support for or sponsor work authorization or visas for this role, including but not limited to F-1 CPT, F-1 OPT, F-1 STEM OPT, J-1, H-1B, TN, O-1, E-3, H-1B1, or L-1."
Also "What You Should Bring" includes many skill/experience items; could be considered Skills or Qualifications. We'll treat "What You Should Bring" as Skills (or Qualifications). The instructions: Use headings for Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We have both Qualifications and Skills. We'll put "Qualifications" for basic qualifications (education, experience, work auth). And "Skills" for the deeper technical abilities.
Benefits: The paragraph about benefits: "In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities)." Also mention company bonus.
Pay: "Actual compensation will depend on a candidate’s education, experience, skills, and geographic location. The anticipated wage for this position is $163,500 - $297,000 Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance)."
Schedule: Not explicitly mentioned; maybe full-time implied. No explicit schedule details. So we should not create Schedule section.
We need to remove boilerplate: EEO statement, accommodation request, ERGs list, etc. Also remove duplicated lines like "Key Responsibilities" repeated. Also remove navigation etc.
We need to preserve all substantive info; we must not invent or summarize away detail. So we need to keep the specifics: e.g., "High School Diploma/equivalent with 4+ years of experience in Cyber Security, Information Technology, or a related field." etc.
We need to format as HTML fragment: use
for section headings, - for lists,
for prose.
We need to decide what goes into lists vs paragraphs.
For About the role: could be a
containing the summary.
For Responsibilities: we can make a
- list of responsibilities.
For Qualifications: maybe a
with the basic qualifications.
For Skills: a
- list of skills/experience from "What You Should Bring".
For Benefits: a
describing benefits.
For Pay: a
with compensation and bonus.
We must not include headings with empty content.
Let's extract details precisely.
About the role text:
We have: "At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us."
Then role summary: "Principal Security Architect Main Attributes Role summary: Security Architecture & Engineering needs a senior architect to serve as the dedicated security architect for a major strategic program. The program is cloud-heavy, built primarily on AWS with additional cloud platforms in scope, and its workloads handle trade secrets and highly sensitive intellectual property. This person owns the security architecture end to end and is the definitive technical voice on cloud and application security for the program."
We can combine into a paragraph.
Responsibilities: Let's gather distinct responsibilities:
From "Key responsibilities:" bullet: Own the security architecture and risk posture for the assigned program; lead architecture reviews, threat modeling, and risk assessments; drive risk acceptance where residual risk remains; and develop reference architectures, design patterns, and security guidance from recurring requirements.
From "What You'll Be Doing": You will own its security architecture across cloud platforms, data flows, identity, and third-party integrations, and lead architecture reviews, threat modeling, and risk assessments. You will develop reference architectures and design patterns that scale across the program, provide technical direction to engineers supporting the work, and ensure technology is deployed securely and in alignment with enterprise security standards.
From the later "Key Responsibilities" list (multiple lines):
- Own the security architecture and risk posture for an assigned strategic program spanning cloud platforms, data flows, identity, and third-party integrations.
- Conduct architecture and design reviews, threat modeling, and risk assessments across cloud platforms, application components, identity, and integrations.
- Design and review controls for workloads handling trade secrets and highly sensitive intellectual property, covering segmentation, access boundaries, egress controls, encryption and key management, and monitoring.
- Establish secure cloud architecture patterns and extend them consistently across the cloud platforms in scope.
- Apply threat modeling frameworks alongside recognized industry security standards, frameworks, and best practices when evaluating designs and documenting technical guidance.
- Perform threat analysis and modeling to enable business and technical partners to deliver secure solutions integrated with the secure development and operations lifecycle.
- Drive risk acceptance where residual risk cannot be eliminated, framing the decision accurately, securing approvals, and documenting the outcome.
- Develop reference architectures, design patterns, and security guidance from recurring requirements, and partner across Security Architecture & Engineering to bring the right expertise into engagements.
- Provide technical leadership and mentorship to architects and engineers supporting the program.
We need to deduplicate similar items. We'll create a concise list covering all unique responsibilities.
Let's list unique responsibilities:
1. Own the security architecture and risk posture for the assigned strategic program (spanning cloud platforms, data flows, identity, third-party integrations).
2. Lead architecture and design reviews, threat modeling, and risk assessments (across cloud platforms, application components, identity, integrations).
3. Design and review controls for workloads handling trade secrets and highly sensitive intellectual property (segmentation, access boundaries, egress controls, encryption and key management, monitoring).
4. Develop reference architectures, design patterns, and security guidance from recurring requirements.
5. Provide technical direction/leadership and mentorship to engineers and architects supporting the program.
6. Ensure technology is deployed securely and in alignment with enterprise security standards.
7. Drive risk acceptance where residual risk cannot be eliminated (frame decision, secure approvals, document outcome).
8. Apply threat modeling frameworks alongside industry standards/best practices when evaluating designs and documenting guidance.
9. Perform threat analysis and modeling to enable partners to deliver secure solutions integrated with secure development and operations lifecycle.
10. Establish secure cloud architecture patterns and extend them consistently across cloud platforms in scope.
We could combine some but keep as separate li.
Qualifications (basic):
- High School Diploma/equivalent with 4+ years of experience in Cyber Security, Information Technology, or a related field.
- 8+ years of professional experience across security, software engineering, cloud engineering, or a combination, including hands-on cloud security work.
- Qualified applicants must be authorized to work in the United States on a full-time basis.
- Lilly will not provide support for or sponsor work authorization or visas for this role (list of visa types).
We could keep as a paragraph or list. Since it's qualifications, maybe a
- . But instructions: Use
- for any list of duties/requirements/benefits. Qualifications are requirements, so list.
Skills (What You Should Bring):
We need to extract each bullet:
- Security depth sufficient to make sound judgment calls on real designs.
- Backgrounds vary and all of the following are relevant paths: building and operating secure systems, security engineering, incident response, penetration testing, or security architecture.
- Depth in at least one major cloud platform (AWS, Azure, or GCP), covering identity and access management, network architecture, workload protection, encryption and key management, and cloud security posture management, with the ability to apply that depth across additional providers.
- Demonstrated experience securing workloads handling trade secrets or highly sensitive intellectual property, including segmentation, access boundaries, and egress controls.
- Strong understanding of secure application development and the secure software development lifecycle, including threat mitigation techniques.
- Strong experience in threat analysis and modeling, and a solid understanding of cybersecurity engineering and operations.
- Exceptional critical thinking and analytical reasoning, with proven ability to define and influence security strategy while also guiding tactical work.
- Ability to translate technical risk into clear business language and to document risk decisions in a form that holds up to audit and executive review.
- Excellent communication and presentation skills, with the ability to adapt messaging for technical and non-technical audiences.
- Experience developing and documenting architecture references, security guidelines, and standards, and mentoring more junior architects and engineers.
We'll put as
- .
Benefits:
- Eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; well-being benefits (e.g., employee assistance program,
for section headings, - for lists,
for prose.
We need to decide what goes into lists vs paragraphs.
For About the role: could be a
containing the summary.
For Responsibilities: we can make a
- list of responsibilities.
For Qualifications: maybe a
with the basic qualifications.
For Skills: a
- list of skills/experience from "What You Should Bring".
For Benefits: a
describing benefits.
For Pay: a
with compensation and bonus.
We must not include headings with empty content.
Let's extract details precisely.
About the role text:
We have: "At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us."
Then role summary: "Principal Security Architect Main Attributes Role summary: Security Architecture & Engineering needs a senior architect to serve as the dedicated security architect for a major strategic program. The program is cloud-heavy, built primarily on AWS with additional cloud platforms in scope, and its workloads handle trade secrets and highly sensitive intellectual property. This person owns the security architecture end to end and is the definitive technical voice on cloud and application security for the program."
We can combine into a paragraph.
Responsibilities: Let's gather distinct responsibilities:
From "Key responsibilities:" bullet: Own the security architecture and risk posture for the assigned program; lead architecture reviews, threat modeling, and risk assessments; drive risk acceptance where residual risk remains; and develop reference architectures, design patterns, and security guidance from recurring requirements.
From "What You'll Be Doing": You will own its security architecture across cloud platforms, data flows, identity, and third-party integrations, and lead architecture reviews, threat modeling, and risk assessments. You will develop reference architectures and design patterns that scale across the program, provide technical direction to engineers supporting the work, and ensure technology is deployed securely and in alignment with enterprise security standards.
From the later "Key Responsibilities" list (multiple lines):
- Own the security architecture and risk posture for an assigned strategic program spanning cloud platforms, data flows, identity, and third-party integrations.
- Conduct architecture and design reviews, threat modeling, and risk assessments across cloud platforms, application components, identity, and integrations.
- Design and review controls for workloads handling trade secrets and highly sensitive intellectual property, covering segmentation, access boundaries, egress controls, encryption and key management, and monitoring.
- Establish secure cloud architecture patterns and extend them consistently across the cloud platforms in scope.
- Apply threat modeling frameworks alongside recognized industry security standards, frameworks, and best practices when evaluating designs and documenting technical guidance.
- Perform threat analysis and modeling to enable business and technical partners to deliver secure solutions integrated with the secure development and operations lifecycle.
- Drive risk acceptance where residual risk cannot be eliminated, framing the decision accurately, securing approvals, and documenting the outcome.
- Develop reference architectures, design patterns, and security guidance from recurring requirements, and partner across Security Architecture & Engineering to bring the right expertise into engagements.
- Provide technical leadership and mentorship to architects and engineers supporting the program.
We need to deduplicate similar items. We'll create a concise list covering all unique responsibilities.
Let's list unique responsibilities:
1. Own the security architecture and risk posture for the assigned strategic program (spanning cloud platforms, data flows, identity, third-party integrations).
2. Lead architecture and design reviews, threat modeling, and risk assessments (across cloud platforms, application components, identity, integrations).
3. Design and review controls for workloads handling trade secrets and highly sensitive intellectual property (segmentation, access boundaries, egress controls, encryption and key management, monitoring).
4. Develop reference architectures, design patterns, and security guidance from recurring requirements.
5. Provide technical direction/leadership and mentorship to engineers and architects supporting the program.
6. Ensure technology is deployed securely and in alignment with enterprise security standards.
7. Drive risk acceptance where residual risk cannot be eliminated (frame decision, secure approvals, document outcome).
8. Apply threat modeling frameworks alongside industry standards/best practices when evaluating designs and documenting guidance.
9. Perform threat analysis and modeling to enable partners to deliver secure solutions integrated with secure development and operations lifecycle.
10. Establish secure cloud architecture patterns and extend them consistently across cloud platforms in scope.
We could combine some but keep as separate li.
Qualifications (basic):
- High School Diploma/equivalent with 4+ years of experience in Cyber Security, Information Technology, or a related field.
- 8+ years of professional experience across security, software engineering, cloud engineering, or a combination, including hands-on cloud security work.
- Qualified applicants must be authorized to work in the United States on a full-time basis.
- Lilly will not provide support for or sponsor work authorization or visas for this role (list of visa types).
We could keep as a paragraph or list. Since it's qualifications, maybe a
- . But instructions: Use
- for any list of duties/requirements/benefits. Qualifications are requirements, so list.
Skills (What You Should Bring):
We need to extract each bullet:
- Security depth sufficient to make sound judgment calls on real designs.
- Backgrounds vary and all of the following are relevant paths: building and operating secure systems, security engineering, incident response, penetration testing, or security architecture.
- Depth in at least one major cloud platform (AWS, Azure, or GCP), covering identity and access management, network architecture, workload protection, encryption and key management, and cloud security posture management, with the ability to apply that depth across additional providers.
- Demonstrated experience securing workloads handling trade secrets or highly sensitive intellectual property, including segmentation, access boundaries, and egress controls.
- Strong understanding of secure application development and the secure software development lifecycle, including threat mitigation techniques.
- Strong experience in threat analysis and modeling, and a solid understanding of cybersecurity engineering and operations.
- Exceptional critical thinking and analytical reasoning, with proven ability to define and influence security strategy while also guiding tactical work.
- Ability to translate technical risk into clear business language and to document risk decisions in a form that holds up to audit and executive review.
- Excellent communication and presentation skills, with the ability to adapt messaging for technical and non-technical audiences.
- Experience developing and documenting architecture references, security guidelines, and standards, and mentoring more junior architects and engineers.
We'll put as
- .
Benefits:
- Eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; well-being benefits (e.g., employee assistance program,
for prose. We need to decide what goes into lists vs paragraphs. For About the role: could be a
containing the summary. For Responsibilities: we can make a
- list of responsibilities.
For Qualifications: maybe a
with the basic qualifications. For Skills: a
- list of skills/experience from "What You Should Bring".
For Benefits: a
describing benefits. For Pay: a
with compensation and bonus. We must not include headings with empty content. Let's extract details precisely. About the role text: We have: "At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us." Then role summary: "Principal Security Architect Main Attributes Role summary: Security Architecture & Engineering needs a senior architect to serve as the dedicated security architect for a major strategic program. The program is cloud-heavy, built primarily on AWS with additional cloud platforms in scope, and its workloads handle trade secrets and highly sensitive intellectual property. This person owns the security architecture end to end and is the definitive technical voice on cloud and application security for the program." We can combine into a paragraph. Responsibilities: Let's gather distinct responsibilities: From "Key responsibilities:" bullet: Own the security architecture and risk posture for the assigned program; lead architecture reviews, threat modeling, and risk assessments; drive risk acceptance where residual risk remains; and develop reference architectures, design patterns, and security guidance from recurring requirements. From "What You'll Be Doing": You will own its security architecture across cloud platforms, data flows, identity, and third-party integrations, and lead architecture reviews, threat modeling, and risk assessments. You will develop reference architectures and design patterns that scale across the program, provide technical direction to engineers supporting the work, and ensure technology is deployed securely and in alignment with enterprise security standards. From the later "Key Responsibilities" list (multiple lines): - Own the security architecture and risk posture for an assigned strategic program spanning cloud platforms, data flows, identity, and third-party integrations. - Conduct architecture and design reviews, threat modeling, and risk assessments across cloud platforms, application components, identity, and integrations. - Design and review controls for workloads handling trade secrets and highly sensitive intellectual property, covering segmentation, access boundaries, egress controls, encryption and key management, and monitoring. - Establish secure cloud architecture patterns and extend them consistently across the cloud platforms in scope. - Apply threat modeling frameworks alongside recognized industry security standards, frameworks, and best practices when evaluating designs and documenting technical guidance. - Perform threat analysis and modeling to enable business and technical partners to deliver secure solutions integrated with the secure development and operations lifecycle. - Drive risk acceptance where residual risk cannot be eliminated, framing the decision accurately, securing approvals, and documenting the outcome. - Develop reference architectures, design patterns, and security guidance from recurring requirements, and partner across Security Architecture & Engineering to bring the right expertise into engagements. - Provide technical leadership and mentorship to architects and engineers supporting the program. We need to deduplicate similar items. We'll create a concise list covering all unique responsibilities. Let's list unique responsibilities: 1. Own the security architecture and risk posture for the assigned strategic program (spanning cloud platforms, data flows, identity, third-party integrations). 2. Lead architecture and design reviews, threat modeling, and risk assessments (across cloud platforms, application components, identity, integrations). 3. Design and review controls for workloads handling trade secrets and highly sensitive intellectual property (segmentation, access boundaries, egress controls, encryption and key management, monitoring). 4. Develop reference architectures, design patterns, and security guidance from recurring requirements. 5. Provide technical direction/leadership and mentorship to engineers and architects supporting the program. 6. Ensure technology is deployed securely and in alignment with enterprise security standards. 7. Drive risk acceptance where residual risk cannot be eliminated (frame decision, secure approvals, document outcome). 8. Apply threat modeling frameworks alongside industry standards/best practices when evaluating designs and documenting guidance. 9. Perform threat analysis and modeling to enable partners to deliver secure solutions integrated with secure development and operations lifecycle. 10. Establish secure cloud architecture patterns and extend them consistently across cloud platforms in scope. We could combine some but keep as separate li. Qualifications (basic): - High School Diploma/equivalent with 4+ years of experience in Cyber Security, Information Technology, or a related field. - 8+ years of professional experience across security, software engineering, cloud engineering, or a combination, including hands-on cloud security work. - Qualified applicants must be authorized to work in the United States on a full-time basis. - Lilly will not provide support for or sponsor work authorization or visas for this role (list of visa types). We could keep as a paragraph or list. Since it's qualifications, maybe a
- . But instructions: Use
- for any list of duties/requirements/benefits. Qualifications are requirements, so list.
Skills (What You Should Bring):
We need to extract each bullet:
- Security depth sufficient to make sound judgment calls on real designs.
- Backgrounds vary and all of the following are relevant paths: building and operating secure systems, security engineering, incident response, penetration testing, or security architecture.
- Depth in at least one major cloud platform (AWS, Azure, or GCP), covering identity and access management, network architecture, workload protection, encryption and key management, and cloud security posture management, with the ability to apply that depth across additional providers.
- Demonstrated experience securing workloads handling trade secrets or highly sensitive intellectual property, including segmentation, access boundaries, and egress controls.
- Strong understanding of secure application development and the secure software development lifecycle, including threat mitigation techniques.
- Strong experience in threat analysis and modeling, and a solid understanding of cybersecurity engineering and operations.
- Exceptional critical thinking and analytical reasoning, with proven ability to define and influence security strategy while also guiding tactical work.
- Ability to translate technical risk into clear business language and to document risk decisions in a form that holds up to audit and executive review.
- Excellent communication and presentation skills, with the ability to adapt messaging for technical and non-technical audiences.
- Experience developing and documenting architecture references, security guidelines, and standards, and mentoring more junior architects and engineers.
We'll put as
- . Benefits: - Eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; well-being benefits (e.g., employee assistance program,
- for any list of duties/requirements/benefits. Qualifications are requirements, so list.
Skills (What You Should Bring):
We need to extract each bullet:
- Security depth sufficient to make sound judgment calls on real designs.
- Backgrounds vary and all of the following are relevant paths: building and operating secure systems, security engineering, incident response, penetration testing, or security architecture.
- Depth in at least one major cloud platform (AWS, Azure, or GCP), covering identity and access management, network architecture, workload protection, encryption and key management, and cloud security posture management, with the ability to apply that depth across additional providers.
- Demonstrated experience securing workloads handling trade secrets or highly sensitive intellectual property, including segmentation, access boundaries, and egress controls.
- Strong understanding of secure application development and the secure software development lifecycle, including threat mitigation techniques.
- Strong experience in threat analysis and modeling, and a solid understanding of cybersecurity engineering and operations.
- Exceptional critical thinking and analytical reasoning, with proven ability to define and influence security strategy while also guiding tactical work.
- Ability to translate technical risk into clear business language and to document risk decisions in a form that holds up to audit and executive review.
- Excellent communication and presentation skills, with the ability to adapt messaging for technical and non-technical audiences.
- Experience developing and documenting architecture references, security guidelines, and standards, and mentoring more junior architects and engineers.
We'll put as
- . But instructions: Use
- list of skills/experience from "What You Should Bring".
For Benefits: a