Security Automation Engineer

What You’ll Be Doing As a Security Automation Engineer, you'll spend most of your time designing and building automations and internal tooling that streamline our security team’s workflows—from triage and reporting to evidence gathering, scan orchestration, and repetitive tasks. You'll also partner directly with software engineering teams to remediate vulnerabilities, translate findings into actionable guidance, and support secure‑by‑default practices. How You’ll Succeed Design, write, and maintain automated workflows and tools for triage, reporting, evidence gathering, scan orchestration, and repetitive review tasks. Build integrations across the security stack (scanners, ticketing, source control, cloud and asset systems) to enable automatic data flow. Identify manual, repetitive work and replace it with reliable, well‑documented automation. Stand up and improve the pipelines and services the team relies on, ensuring reliability and maintainability. Prototype quickly using modern tooling, including AI coding assistants, then harden successful prototypes into durable tools. Operate as a self‑directed engineer, taking ambiguous problems end‑to‑end with minimal direction. Partner with development teams, pairing in their codebases to remediate vulnerabilities and explain the reasoning behind fixes. Translate security findings, standards, and threat models into clear, actionable guidance tailored to each team’s context. Share the tools and patterns built so teams can adopt secure‑by‑default practices on their own. What You Should Bring Strong general‑purpose programming skills and a bias toward automating repetitive work. Experience building integrations, services, scripts, or internal tools that connect systems and remove manual steps. Experience automating or orchestrating security or DevOps tooling such as scanners, pipelines, ticketing, or cloud APIs. Ability to take ambiguous problems and deliver working solutions with minimal direction. Comfort using AI coding assistants to prototype and ship. Comfort partnering with and coaching developers, explaining security clearly, and meeting teams where they are. Familiarity with application security fundamentals such as OWASP Top10, CWE, secure coding practices, and threat modeling. Experience helping teams interpret and remediate findings from SAST, DAST, SCA, or secret‑scanning tools. Working knowledge of modern CI/CD pipelines and cloud environments. Relevant certifications (e.g., CSSLP, GIAC GWEB/GSSP, OSCP, or similar) are preferred but not required. Basic Requirements Minimum of a High School Diploma/GED. At least 1 year of professional software development experience with individual contributions to production systems. Demonstrated production coding experience in at least one of: Python, TypeScript/JavaScript, Java, Go, or C#. Experience building automation, integrations, or internal tooling. Qualified applicants must be authorized to work in the United States on a full‑time basis. Lilly will not provide support for or sponsor work authorization or visas for this role. Lilly is proud to be an EEO Employer and does not discriminate on the basis of age, race, color, religion, gender identity, sex, gender expression, sexual orientation, genetic information, ancestry, national origin, protected veteran status, disability, or any other legally protected status. #J-18808-Ljbffr