Sr. Principal Security Engineer, Application Security Strategy & Architecture

At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve.

This is hard, urgent, selfless work-but it's work worth doing. If you're driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us.

** What You'll Be Doing:*
* As a Sr. Principal Security Engineer, you will serve as a senior technical leader within the Security Architecture & Engineering (SAE) organization, leading strategy and architecture across Lilly's Application Security program. You will provide architectural direction, lead tool evaluation and selection, drive critical security transformation initiatives and serve as a trusted technical advisor to the Director of Application Security on program-level execution risk.

This is a high-judgment, senior individual contributor role for someone who can operate at the strategic and architectural level while remaining credible in technical depth.

** How You'll Succeed:*
* +  
** Architectural thinking:
** You design security solutions at a program level-defining reference architectures, evaluating build vs. buy tradeoffs, and ensuring that platform decisions made today don't create constraints tomorrow. You can translate a business or compliance requirement into an architectural pattern engineers can execute against.

+  
** Strategic tool evaluation:
** You know how to run a rigorous evaluation of security tooling-SAST, DAST, SCA, penetration testing platforms, and AI-augmented security tools. You can define criteria, structure a proof of concept, assess vendor capability against Lilly's environment, and make a defensible recommendation to leadership.

+  
** Program-level risk judgment:
** You identify where App Sec execution is at risk before things go wrong. You surface those risks clearly and come with options, not just concerns.

+  
** Enterprise transformation experience:
** You have led or architected large-scale security or identity migrations and understand the full scope of what breaks when a foundational platform changes. You know how to sequence a program-level effort, run dependencies, and keep security coverage intact through the transition.

+  
** Engineering credibility:
** You can engage at a technical level with security engineers and software developers alike. You understand CI/CD pipelines, developer workflows, and how App Sec controls interact with the systems they protect.

+  
** Developer partnership:
** You build trust with engineering teams by understanding their constraints and framing security requirements as solvable engineering problems-not mandates.

*
* Key Responsibilities:

*
* ** App Sec Strategy & Architecture*
* + Define and maintain the architectural direction for Lilly's Secure SDLC program, including SAST, DAST, SCA, secrets management, and software supply chain capabilities.

+ Partner with the Director of Application Security to identify and communicate program-level execution risks and dependencies.

+ Translate regulatory, compliance, and audit requirements into security architecture that engineering teams can implement and sustain.

** Tool Evaluation & Selection*
* + Lead structured evaluations of security tooling across SAST, DAST, SCA, penetration testing, and AI-augmented security platforms.

+ Define evaluation criteria, design proof-of-concept engagements, assess vendor capabilities against Lilly's environment and scale, and produce recommendation packages for leadership decision-making.

+ Maintain awareness of the App Sec tooling landscape and advise on emerging capabilities-including AI-driven security tools-that warrant evaluation or adoption.

+ Partner with procurement, legal, and engineering collaborators to support vendor selection and contract alignment.

** Enterprise Platform Security Transformation*
* + Serve as the App…