Senior Cloud Security Engineer

At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work-but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us.

Cloud Security Engineer

Lilly's Security Architecture and Engineering team is looking for a Cloud Security Engineer who is, first and foremost, a builder. Most of your time will go to designing and writing the automation behind CloudSec as a Service, working alongside the engineers who build and maintain it, and helping hunt down the manual, repetitive work that slows the team down. You'll have support and guidance as you grow into the role, but you should be the kind of engineer who enjoys figuring things out rather than waiting to be told exactly how.

What You'll Be Doing

You'll help drive automation across the CloudSec team, designing, testing, and deploying automated solutions in line with Lilly SDLC practices, and following them through to production rather than handing off once something's built.

You'll help maintain the Feature Request backlog for CloudSec services and tooling, tracking requests and helping spot opportunities for continuous improvement, including hunting down repetitive manual work worth automating.

You'll work with the teams consuming what you build, helping design, test, and implement new security controls across the organisation, and staying close enough to real use cases to understand what actually works for the people using it. You'll also support the wider Lilly development community with strong development controls and practices, and contribute ideas to the CloudSec service roadmap.

How You'll Succeed

You're comfortable working with some ambiguity. Not every task comes with step-by-step instructions, and you're willing to work through a problem and ask good questions along the way rather than needing everything handed to you. You look for repetitive manual work worth automating, and with guidance, you can spot opportunities within existing tools and processes to build something useful.

You're building the habit of treating infrastructure changes with the same care as application code, testing your automation before it reaches production, and thinking about how a deployment could fail safely rather than assuming it won't. You deliver visible progress at regular intervals rather than disappearing and reappearing with a finished thing, and you're developing the habit of documenting your work as you go, so someone else could pick it up if they needed to.

Security itself can be learned on the job, but you should already understand why certain security decisions get made (access management, encryption, SDLC gates for things like vulnerability management), even without deep specialisation.

Basic Qualifications

• A BSc in Computer Science or a related IT field, or equivalent industry experience
• 1 to 3 years of relevant industry experience
• Proficiency in at least one modern programming language (e.g. Python)
• Exposure to Infrastructure as Code (e.g. Terraform)
• Some exposure to at least one major CSP (AWS, Azure, or GCP)
• Some exposure to CI/CD pipelines (e.g. Azure DevOps, GitHub Actions, Jenkins)
• Working experience with version control and collaborative development practices (branching, pull requests, code review)

Additional Skills

• Comfort working across more than one scripting or programming language (e.g. Python, PowerShell, Bash, .NET)
• Exposure to configuration management, distinct from provisioning (e.g. Ansible)
• Experience integrating with tools via APIs, including handling authentication (tokens, service accounts)
• Awareness of safe deployment strategies (e.g. blue-green, canary, rollback planning)
• Experience with container image creation and curation
• Comfort using AI-assisted tooling to help figure things out and move quickly
• Experience across multiple cloud platforms is a plus, though not a requirement

Lilly is dedicated to helping individuals with disabilities to actively engage in the workforce, ensuring equal opportunities when vying for positions. If you require accommodation to submit a resume for a position at Lilly, please complete the accommodation request form (https://careers.lilly.com/us/en/workplace-accommodation) for further assistance. Please note this is for individuals to request an accommodation as part of the application process and any other correspondence will not receive a response.

Lilly does not discriminate on the basis of age, race, color, religion, gender, sexual orientation, gender identity, gender expression, national origin, protected veteran status, disability or any other legally protected status.

Actual compensation will depend on a candidate’s education, experience, skills, and geographic location. The anticipated wage for this position is

Full-time equivalent employees may also be eligible for a company bonus (depending, in part, on company and individual performance). In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a pension plan; vacation benefits; eligibility for healthcare benefits; flexible benefits (if applicable) life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities). Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly’s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees.