Principal Security Architect
for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content.
We need to preserve all substantive info, not invent. Remove boilerplate: EEO, accommodation request, legal, etc. Also remove duplicated lines.
We need to decide which sections to include.
Content:
- Intro paragraph about Lilly: could be "About the role"? Actually "About the role" maybe includes description of role and company. Could use "About the role" heading.
- Role summary: "Principal Security Architect Main Attributes Role summary: ..." Could be part of About the role.
- Responsibilities: there is "Key responsibilities" and later "Key Responsibilities" repeated. So we can include Responsibilities section.
- Qualifications: there is "Qualifications:" and later "What You Should Bring" and "Your Basic Qualifications". So we can include Qualifications section.
- Skills: maybe "What You Should Bring" includes skills; but we already have Qualifications. Could also have Skills section separate if distinct. But we can combine.
- Benefits: there is description of benefits: "In addition, Lilly offers a comprehensive benefit program..." So we can include Benefits.
- Pay: there is "Actual compensation will depend... The anticipated wage for this position is $163,500 - $297,000 Full-time equivalent employees also will be eligible for a company bonus..." So we can include Pay.
- Schedule: not mentioned explicitly; maybe full-time implied but not explicit schedule. So we should not create Schedule section.
We need to avoid filler like "commensurate with experience". Not present.
We need to output only HTML fragment, no /. Use headings, - for lists,
for prose.
We need to preserve all substantive info; not invent or summarize away detail. So we need to include details like responsibilities list items, qualifications list items, benefits list items, pay info.
We need to remove duplicated lines. Ensure not to repeat same content.
Let's extract content.
Intro paragraph: "At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us."
That's about company and role invitation. Could be placed under About the role.
Role summary: "Principal Security Architect Main Attributes Role summary: Security Architecture & Engineering needs a senior architect to serve as the dedicated security architect for a major strategic program. The program is cloud-heavy, built primarily on AWS with additional cloud platforms in scope, and its workloads handle trade secrets and highly sensitive intellectual property. This person owns the security architecture end to end and is the definitive technical voice on cloud and application security for the program."
We can combine with intro.
Responsibilities: list items from "Key responsibilities" and later "Key Responsibilities". Let's extract unique bullet points:
From first "Key responsibilities:":
- Own the security architecture and risk posture for the assigned program;
- lead architecture reviews, threat modeling, and risk assessments;
- drive risk acceptance where residual risk remains;
- and develop reference architectures, design patterns, and security guidance from recurring requirements.
Later "Key Responsibilities" (capitalized) list:
- Own the security architecture and risk posture for an assigned strategic program spanning cloud platforms, data flows, identity, and third-party integrations.
- Conduct architecture and design reviews, threat modeling, and risk assessments across cloud platforms, application components, identity, and integrations.
- Design and review controls for workloads handling trade secrets and highly sensitive intellectual property, covering segmentation, access boundaries, egress controls, encryption and key management, and monitoring.
- Establish secure cloud architecture patterns and extend them consistently across the cloud platforms in scope.
- Apply threat modeling frameworks alongside recognized industry security standards, frameworks, and best practices when evaluating designs and documenting technical guidance.
- Perform threat analysis and modeling to enable business and technical partners to deliver secure solutions integrated with the secure development and operations lifecycle.
- Drive risk acceptance where residual risk cannot be eliminated, framing the decision accurately, securing approvals, and documenting the outcome.
- Develop reference architectures, design patterns, and security guidance from recurring requirements, and partner across Security Architecture & Engineering to bring the right expertise into engagements.
- Provide technical leadership and mentorship to architects and engineers supporting the program.
We need to combine and deduplicate. Many overlap. We'll produce a concise but comprehensive list covering all unique points.
Qualifications: from "Qualifications:" and "What You Should Bring" and "Your Basic Qualifications".
Qualifications bullet points:
- Deep security expertise across cloud, application security, identity, and integration patterns.
- Experience designing controls for workloads handling trade secrets or sensitive intellectual property.
- Background is open—building and operating secure systems, security engineering, incident response, and security architecture are all relevant paths, provided the depth supports sound judgment on real designs.
What You Should Bring:
- Security depth sufficient to make sound judgment calls on real designs.
- Backgrounds vary and all of the following are relevant paths: building and operating secure systems, security engineering, incident response, penetration testing, or security architecture.
- Depth in at least one major cloud platform (AWS, Azure, or GCP), covering identity and access management, network architecture, workload protection, encryption and key management, and cloud security posture management, with the ability to apply that depth across additional providers.
- Demonstrated experience securing workloads handling trade secrets or highly sensitive intellectual property, including segmentation, access boundaries, and egress controls.
- Strong understanding of secure application development and the secure software development lifecycle, including threat mitigation techniques.
- Strong experience in threat analysis and modeling, and a solid understanding of cybersecurity engineering and operations.
- Exceptional critical thinking and analytical reasoning, with proven ability to define and influence security strategy while also guiding tactical work.
- Ability to translate technical risk into clear business language and to document risk decisions in a form that holds up to audit and executive review.
- Excellent communication and presentation skills, with the ability to adapt messaging for technical and non-technical audiences.
- Experience developing and documenting architecture references, security guidelines, and standards, and mentoring more junior architects and engineers.
Your Basic Qualifications:
- High School Diploma/equivalent with 4+ years of experience in Cyber Security, Information Technology, or a related field.
- 8+ years of professional experience across security, software engineering, cloud engineering, or a combination, including hands-on cloud security work.
- Qualified applicants must be authorized to work in the United States on a full-time basis.
- Lilly will not provide support for or sponsor work authorization or visas for this role, including but not limited to F-1 CPT, F-1 OPT, F-1 STEM OPT, J-1, H-1B, TN, O-1, E-3, H-1B1, or L-1.
We need to keep substantive info; but the visa sponsorship statement is maybe considered boilerplate? It's a requirement; but it's about work authorization. Might be considered relevant. However instructions: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The visa sponsorship statement is not exactly those categories; it's a requirement about work authorization. Might be okay to keep. But it's somewhat legal. However it's a condition of employment. I'd keep it as part of Qualifications.
Benefits: "In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities). Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly’s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees."
We can list benefits as bullet points.
Pay: "Actual compensation will depend on a candidate’s education, experience, skills, and geographic location. The anticipated wage for this position is $163,500 - $297,000 Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance)."
We can put that in Pay section.
Schedule: not present, so omit.
Now produce HTML.
Structure:
About the role
Intro paragraph + role summary combined.
Responsibilities
- ... each responsibility
Qualifications
- ... each qualification
Benefits
- ... each benefit
Pay
... pay info
We need to ensure we don't repeat content. Let's craft.
About the role paragraph: combine intro and role summary.
Intro: "At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us."
Role summary: "Principal Security Architect: Security Architecture & Engineering needs a senior architect to serve as the dedicated security architect for a major strategic program. The program is cloud-heavy, built primarily on AWS with additional cloud platforms in scope, and its workloads handle trade secrets and highly sensitive intellectual property. This person owns the security architecture end to end and is the definitive technical voice on cloud and application security for the program."
We can combine into one paragraph.
Now Responsibilities list: Let's create unique items:
- Own the security architecture and risk posture for an assigned strategic program spanning cloud platforms, data flows, identity, and third-party integrations.
- Conduct architecture and design reviews, threat modeling, and risk assessments across cloud platforms, application components, identity, and integrations.
- Design and review controls for workloads handling trade secrets and highly sensitive intellectual property, covering segmentation, access boundaries, egress controls, encryption and key management, and monitoring.
- Establish secure cloud architecture patterns and extend them consistently across the cloud platforms in scope.
- Apply threat modeling frameworks alongside recognized industry security standards, frameworks, and best practices when evaluating designs and documenting technical guidance.
- Perform threat analysis and modeling to enable business and technical partners to deliver secure solutions integrated with the secure development and operations lifecycle.
- Drive risk acceptance where residual risk cannot be eliminated, framing the decision accurately, securing approvals, and documenting the outcome.
- Develop reference architectures, design patterns, and security guidance from recurring requirements, and partner across Security Architecture & Engineering to bring the right expertise into engagements.
- Provide technical leadership and mentorship to architects and engineers supporting the program.
That's comprehensive.
Qualifications list: combine unique items.
- Deep security expertise across cloud, application security, identity, and integration patterns.
- Experience designing controls for workloads handling trade secrets or sensitive intellectual property.
- Background in building and operating secure systems, security engineering, incident response, penetration testing, or security architecture, with sufficient depth to make sound judgment calls on real
- for lists,
for prose. We need to preserve all substantive info; not invent or summarize away detail. So we need to include details like responsibilities list items, qualifications list items, benefits list items, pay info. We need to remove duplicated lines. Ensure not to repeat same content. Let's extract content. Intro paragraph: "At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us." That's about company and role invitation. Could be placed under About the role. Role summary: "Principal Security Architect Main Attributes Role summary: Security Architecture & Engineering needs a senior architect to serve as the dedicated security architect for a major strategic program. The program is cloud-heavy, built primarily on AWS with additional cloud platforms in scope, and its workloads handle trade secrets and highly sensitive intellectual property. This person owns the security architecture end to end and is the definitive technical voice on cloud and application security for the program." We can combine with intro. Responsibilities: list items from "Key responsibilities" and later "Key Responsibilities". Let's extract unique bullet points: From first "Key responsibilities:": - Own the security architecture and risk posture for the assigned program; - lead architecture reviews, threat modeling, and risk assessments; - drive risk acceptance where residual risk remains; - and develop reference architectures, design patterns, and security guidance from recurring requirements. Later "Key Responsibilities" (capitalized) list: - Own the security architecture and risk posture for an assigned strategic program spanning cloud platforms, data flows, identity, and third-party integrations. - Conduct architecture and design reviews, threat modeling, and risk assessments across cloud platforms, application components, identity, and integrations. - Design and review controls for workloads handling trade secrets and highly sensitive intellectual property, covering segmentation, access boundaries, egress controls, encryption and key management, and monitoring. - Establish secure cloud architecture patterns and extend them consistently across the cloud platforms in scope. - Apply threat modeling frameworks alongside recognized industry security standards, frameworks, and best practices when evaluating designs and documenting technical guidance. - Perform threat analysis and modeling to enable business and technical partners to deliver secure solutions integrated with the secure development and operations lifecycle. - Drive risk acceptance where residual risk cannot be eliminated, framing the decision accurately, securing approvals, and documenting the outcome. - Develop reference architectures, design patterns, and security guidance from recurring requirements, and partner across Security Architecture & Engineering to bring the right expertise into engagements. - Provide technical leadership and mentorship to architects and engineers supporting the program. We need to combine and deduplicate. Many overlap. We'll produce a concise but comprehensive list covering all unique points. Qualifications: from "Qualifications:" and "What You Should Bring" and "Your Basic Qualifications". Qualifications bullet points: - Deep security expertise across cloud, application security, identity, and integration patterns. - Experience designing controls for workloads handling trade secrets or sensitive intellectual property. - Background is open—building and operating secure systems, security engineering, incident response, and security architecture are all relevant paths, provided the depth supports sound judgment on real designs. What You Should Bring: - Security depth sufficient to make sound judgment calls on real designs. - Backgrounds vary and all of the following are relevant paths: building and operating secure systems, security engineering, incident response, penetration testing, or security architecture. - Depth in at least one major cloud platform (AWS, Azure, or GCP), covering identity and access management, network architecture, workload protection, encryption and key management, and cloud security posture management, with the ability to apply that depth across additional providers. - Demonstrated experience securing workloads handling trade secrets or highly sensitive intellectual property, including segmentation, access boundaries, and egress controls. - Strong understanding of secure application development and the secure software development lifecycle, including threat mitigation techniques. - Strong experience in threat analysis and modeling, and a solid understanding of cybersecurity engineering and operations. - Exceptional critical thinking and analytical reasoning, with proven ability to define and influence security strategy while also guiding tactical work. - Ability to translate technical risk into clear business language and to document risk decisions in a form that holds up to audit and executive review. - Excellent communication and presentation skills, with the ability to adapt messaging for technical and non-technical audiences. - Experience developing and documenting architecture references, security guidelines, and standards, and mentoring more junior architects and engineers. Your Basic Qualifications: - High School Diploma/equivalent with 4+ years of experience in Cyber Security, Information Technology, or a related field. - 8+ years of professional experience across security, software engineering, cloud engineering, or a combination, including hands-on cloud security work. - Qualified applicants must be authorized to work in the United States on a full-time basis. - Lilly will not provide support for or sponsor work authorization or visas for this role, including but not limited to F-1 CPT, F-1 OPT, F-1 STEM OPT, J-1, H-1B, TN, O-1, E-3, H-1B1, or L-1. We need to keep substantive info; but the visa sponsorship statement is maybe considered boilerplate? It's a requirement; but it's about work authorization. Might be considered relevant. However instructions: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The visa sponsorship statement is not exactly those categories; it's a requirement about work authorization. Might be okay to keep. But it's somewhat legal. However it's a condition of employment. I'd keep it as part of Qualifications. Benefits: "In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities). Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly’s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees." We can list benefits as bullet points. Pay: "Actual compensation will depend on a candidate’s education, experience, skills, and geographic location. The anticipated wage for this position is $163,500 - $297,000 Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance)." We can put that in Pay section. Schedule: not present, so omit. Now produce HTML. Structure:
About the role
Intro paragraph + role summary combined.
Responsibilities
- ... each responsibility
Qualifications
- ... each qualification
Benefits
- ... each benefit
Pay
... pay info
We need to ensure we don't repeat content. Let's craft. About the role paragraph: combine intro and role summary. Intro: "At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us." Role summary: "Principal Security Architect: Security Architecture & Engineering needs a senior architect to serve as the dedicated security architect for a major strategic program. The program is cloud-heavy, built primarily on AWS with additional cloud platforms in scope, and its workloads handle trade secrets and highly sensitive intellectual property. This person owns the security architecture end to end and is the definitive technical voice on cloud and application security for the program." We can combine into one paragraph. Now Responsibilities list: Let's create unique items: - Own the security architecture and risk posture for an assigned strategic program spanning cloud platforms, data flows, identity, and third-party integrations. - Conduct architecture and design reviews, threat modeling, and risk assessments across cloud platforms, application components, identity, and integrations. - Design and review controls for workloads handling trade secrets and highly sensitive intellectual property, covering segmentation, access boundaries, egress controls, encryption and key management, and monitoring. - Establish secure cloud architecture patterns and extend them consistently across the cloud platforms in scope. - Apply threat modeling frameworks alongside recognized industry security standards, frameworks, and best practices when evaluating designs and documenting technical guidance. - Perform threat analysis and modeling to enable business and technical partners to deliver secure solutions integrated with the secure development and operations lifecycle. - Drive risk acceptance where residual risk cannot be eliminated, framing the decision accurately, securing approvals, and documenting the outcome. - Develop reference architectures, design patterns, and security guidance from recurring requirements, and partner across Security Architecture & Engineering to bring the right expertise into engagements. - Provide technical leadership and mentorship to architects and engineers supporting the program. That's comprehensive. Qualifications list: combine unique items. - Deep security expertise across cloud, application security, identity, and integration patterns. - Experience designing controls for workloads handling trade secrets or sensitive intellectual property. - Background in building and operating secure systems, security engineering, incident response, penetration testing, or security architecture, with sufficient depth to make sound judgment calls on real