Principal Security Architect

At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us.  Principal Security Architect Main Attributes Role summary:  Security Architecture & Engineering needs a senior architect to serve as the dedicated security architect for a major strategic program. The program is cloud-heavy, built primarily on AWS with additional cloud platforms in scope, and its workloads handle trade secrets and highly sensitive intellectual property. This person owns the security architecture end to end and is the definitive technical voice on cloud and application security for the program.

Deep security expertise across cloud, application security, identity, and integration patterns. Experience designing controls for workloads handling trade secrets or sensitive intellectual property. Background is open—building and operating secure systems, security engineering, incident response, and security architecture are all relevant paths, provided the depth supports sound judgment on real designs.

Own the security architecture and risk posture for the assigned program; lead architecture reviews, threat modeling, and risk assessments; drive risk acceptance where residual risk remains; and develop reference architectures, design patterns, and security guidance from recurring requirements. Collaboration:  This role works directly with program leadership, engineering teams, and partners across Security Architecture & Engineering, Tech@Lilly, privacy, legal, and audit.

As Principal Security Architect on the Security Architecture & Engineering team, you will be the dedicated security architect for a major strategic program built primarily on AWS, with workloads handling trade secrets and highly sensitive intellectual property. You will own its security architecture across cloud platforms, data flows, identity, and third-party integrations, and lead architecture reviews, threat modeling, and risk assessments. You will develop reference architectures and design patterns that scale across the program, provide technical direction to engineers supporting the work, and ensure technology is deployed securely and in alignment with enterprise security standards. How You'll Succeed Technical authority:  You will be senior enough to be taken seriously by experienced engineering leaders and technical enough to demonstrate why a proposed design does not hold up—and to show teams a viable secure alternative. Cloud security depth:  You will bring hands-on cloud security architecture expertise—identity and access management, network architecture, workload protection, encryption and key management, and posture management—with enough breadth to design consistently across a multi-cloud environment. Protecting sensitive intellectual property:  You will design and review controls for workloads handling trade secrets, reasoning about segmentation, access boundaries, egress paths, encryption and key management, monitoring, and third-party exposure, and holding designs to a standard appropriate to what they protect. Security built in early:  You will engage at design time rather than at the end, grounded in a strong understanding of secure application development and the secure software development lifecycle, so security is built in rather than bolted on. Risk evaluation and mitigation:  You will evaluate technical