Principal Security Architect – Lilly China

At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us.

What You'll Be Doing

As Principal Security Architect for Lilly China on the Security Architecture & Engineering team, you will be the senior technical authority for security in the region. You will lead security reviews, drive improvements through threat modeling and risk assessment, and develop reference architectures, design patterns, and security guidance—with a focus on cloud (such as Alibaba Cloud and AWS) and secure application development. You will hold engineering and business partners accountable to Lilly's global security standards while adapting them to China's regulatory landscape, ensuring technology is deployed securely and in alignment with Information Security and enterprise strategy. You will also provide technical direction and mentorship to security engineers in the region, including overseeing their threat-modeling work.

How You'll Succeed

Technical authority & accountability: You will be senior enough to hold people accountable and technical enough to back it up—able to get into the code and the cloud architecture, identify why a proposed solution is unsafe, and clearly articulate what 'good' looks like. You will be trusted to say no to designs that violate security best practices and to guide teams to secure alternatives.

Leadership & communication: You will collaborate with local Lilly China teams and remote global partners, playing a pivotal role in defining, designing, and executing security strategy for the region. Excellent communication, influence, and the ability to build trust across cultures and functions are essential.

Cloud & application security depth: You will craft and help implement security solutions across Alibaba Cloud and AWS, grounded in a strong understanding of secure application development and the SSDLC—so security is built in early rather than bolted on.

Regulatory fluency: You will operate fluently within China's data and cybersecurity regulatory environment (including PIPL, the Cybersecurity Law, the Data Security Law, and MLPS/data-localization requirements) and translate those obligations into practical, secure architecture.

Agility & problem-solving: You will adapt quickly to a changing threat landscape, move at the pace of the adversary, and identify and address threats and opportunities to deliver robust security solutions in a timely manner.

Balancing security and operational needs: You will balance stringent security requirements with operational realities, maintaining Lilly's security posture while showing empathy for the engineering teams' constraints and needs.

Key Responsibilities

• Serve as the senior technical reviewer and decision-maker for security architecture across Lilly China, holding engineering and business partners accountable to enterprise security standards.

• Conduct security consulting engagements across Lilly China, focusing on improvements in threat modeling and risk assessment.

• Develop and maintain technical specifications, design patterns, standards-as-code, and security guidance—with particular emphasis on cloud (Alibaba Cloud, AWS) and secure application development.

• Perform threat analysis and modeling to enable business and technical partners to deliver secure solutions integrated with the secure development and operations lifecycle.

• Apply threat modeling frameworks such as MITRE ATT&CK and STRIDE (or STRIDE-LM), and security-control and architecture frameworks (e.g., Cloud Controls Matrix, NIST CSF, CIS Critical Security Controls, TOGAF, SABSA) to document technical references, guidelines, and standards.

• Ensure designs meet China regulatory obligations (PIPL, Cybersecurity Law, Data Security Law, MLPS/data localization) as well as Lilly global and industry standards.

• Partner with leadership inside and outside Information Security—globally and within Lilly China—to use technology to solve security and business problems.

• Prioritize mitigations relative to technology upgrades, enhancements, and process improvements within areas of accountability.

• Provide technical leadership and mentorship to security engineers in the region, overseeing their threat-modeling projects and fostering their growth.

What You Should Bring

• Proficiency across cloud-based architectures, with primary depth in Alibaba Cloud and AWS.

• Strong understanding of secure application development and the secure software development lifecycle (SSDLC), including threat-mitigation techniques.

• Working knowledge of China's data and cybersecurity regulatory environment (PIPL, Cybersecurity Law, Data Security Law, MLPS/data localization) and experience integrating regulatory and industry standards (e.g., ISO/IEC, GDPR, GxP/FDA where relevant) into cybersecurity designs.

• The seniority and presence to hold partners accountable, and the technical credibility to defend that position with evidence.

• Broad knowledge across multiple technology areas coupled with deep expertise in cloud and application security.

• Exceptional critical thinking, analytical reasoning, and thought leadership.

• Proven ability to define and influence security strategy and vision while also guiding tactical initiatives.

• Excellent communication and presentation skills, with the ability to adapt messaging for diverse, cross-cultural audiences; Mandarin proficiency strongly preferred.

• Experience developing and documenting architecture references, security guidelines, and standards, and applying security controls (e.g., Cloud Controls Matrix, NIST CSF, CIS Critical Security Controls).

• Strong experience in threat analysis and modeling, a solid understanding of cybersecurity engineering/operations, incident response, and GRC functions, and demonstrated mentorship of more junior staff.

Your Basic Qualifications

• Bachelor's Degree in Cyber Security, Computer Science, Information Technology, or a related field; or a High School Diploma/equivalent with 4+ years of experience in Cyber Security, Information Technology, or a related field.

• 8+ years of demonstrated experience in cloud architecture and security, including hands-on experience with Alibaba Cloud and AWS.

• Based in China with the ability to partner across Lilly China and global teams.

Lilly is dedicated to helping individuals with disabilities to actively engage in the workforce, ensuring equal opportunities when vying for positions. If you require accommodation to submit a resume for a position at Lilly, please complete the accommodation request form (https://careers.lilly.com/us/en/workplace-accommodation) for further assistance. Please note this is for individuals to request an accommodation as part of the application process and any other correspondence will not receive a response.

Lilly does not discriminate on the basis of age, race, color, religion, gender, sexual orientation, gender identity, gender expression, national origin, protected veteran status, disability or any other legally protected status.

#WeAreLilly