ETR Lead

At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life\-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us.

Responsibilities

The External Threat Response (ETR) Lead Analyst will operate as one of the functional groups within the Global Cyber Defense Operations (GCDO) team. The ETR Lead Analyst will be responsible for directing and overseeing the execution of the ETR’s strategy and operations while also working effectively with partner organizations. This role requires a strategic thinker with strong leadership capabilities and a deep understanding of digital forensics and incident response and vision to apply automation to the role.

• *Key Objectives/Deliverables:**

• External Threat Response Function Development: Lead the expansion, maintenance, and improvement of the external threat response functions, including the cyber@Lilly mailbox for reporting issues or concerns that need to be analyzed.
• Stakeholder Collaboration: Develop and maintain strong working relationships with key stakeholders in Cyber, Corporate Security, HR, Legal, and Ethics \& Compliance to ensure effective collaboration and support for timely and effective responses to incidents.
• Team Management: Manage a team of cybersecurity Intelligence analysts, providing guidance, mentorship, and support to ensure high performance and professional growth.
• Digital Forensic Investigations: Conduct and oversee internal investigations related to counterintelligence, misuse of assets, and proprietary data theft. Utilize advanced forensic tools and techniques to gather and analyze digital evidence.
• Tooling and Capability Enhancement: Introduce new capabilities and refine existing tools to support the insider threat program. Lead or support critical projects and tooling integrations, such as Axiom, XSOAR, and Splunk.
• Incident Response: Assist in incident response investigations of Advanced Persistent Threat (APT) activity and perform digital forensic analysis of compromised assets.
• eDiscovery and Litigation Support: Conduct eDiscovery requests, including data collection, keyword searches, and creating deliverables for Outside Counsel.
• Training and Awareness: Develop and deliver training programs to enhance the organization's awareness and understanding of external threats and digital forensics.

Basic Qualifications

• HS Diploma or equivalent with 10\+ years of demonstrated experience in Cybersecurity \-OR\- Bachelor’s Degree in Computer Science/Information Technology/Cybersecurity or related with 5\+ years of Cybersecurity experience

Additional Skills/ Preferences

• Hands\-on experience designing and implementing security automation and SOAR playbooks (e.g., XSOAR) to streamline detection, triage, and response.
• Strong analytical and problem\-solving skills.
• Excellent communication and interpersonal skills.
• Ability to work independently and as part of a team.
• Able to provide technical coaching to junior member of ETR team on their cases
• High level of integrity and ethical standards.
• Awareness of AI enabled threats \& use of AI by Cyber defense teams.
• Awareness or knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
• Relevant certifications such as GIAC Computer Incident Handler (GCIH), GIAC Certified Forensic Analyst (GCFA), GIAC network Forensic Analyst (GNFA), GIAC Reverse Engineering Malware (GREM).

Additional Information

Due to the global nature of this position, some international travel may be required.

Lilly is dedicated to helping individuals with disabilities to actively engage in the workforce, ensuring equal opportunities when vying for positions. If you require accommodation to submit a resume for a position at Lilly, please complete the accommodation request form (https://careers.lilly.com/us/en/workplace\-accommodation) for further assistance. Please note this is for individuals to request an accommodation as part of the application process and any other correspondence will not receive a response.

Lilly does not discriminate on the basis of age, race, color, religion, gender, sexual orientation, gender identity, gender expression, national origin, protected veteran status, disability or any other legally protected status.

\#WeAreLilly