Technology Cyber Intelligence Analyst

At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us.

Organization Overview

At Lilly, we serve an extraordinary purpose. We make a difference for people around the globe by discovering, developing and delivering medicines that help them live longer, healthier, more active lives. Not only do we deliver breakthrough medications, but you also can count on us to develop creative solutions to support communities through philanthropy and volunteerism.

Responsibilities

The Cyber Intelligence Analyst will operate in a functional group focusing on any of the following: Cyber Threat Intelligence, Detection and Automation Operations, Cyber Defense Readiness, External Threat Response, and Insider Threat Response.

Analysts typically begin with an assignment in the External Threat Response (ETR) function; however, you may be assigned to any of the core GCDO functions (Cyber Threat Intelligence, Cyber Defense Readiness, Detection and Analysis Operations, Internal Threat Response) based on skills, development needs, and specific needs of the team.

The functions of the GCDO are as follows:

• External Threat Response (ETR): Responsible for the monitoring, detection, analysis, investigation, and response to cybersecurity related events and incidents.

• Cyber Threat Intelligence (CTI): Leading efforts across the organization to consume, contribute, and produce threat intelligence, both internal and external to Lilly. Maintain, develop, and evangelize to partner functions an understanding of threats, attack campaigns and intrusion sets targeting Lilly.

• Cyber Defense Readiness (CDR): Responsible for the integration of key initiatives between the GCDO and the rest of Cybersecurity and other business partners.

• Detection and Analysis Operations (DAO): Responsible for general SecOps and DevOps of GCDO owned capability to empower the organization. Establishing the platform and services to enable the effective detection and monitoring of security events, as well as providing a means to analyze and improve detections.

• Internal Threat Response (ITR): Responsible for the monitoring, analysis, and investigation of cybersecurity related events and incidents, with a focus on the internal workforce.

As part of Lilly's commitment to innovation, you will have the opportunity to build fluency with AI tools used across the business. We expect you to approach these tools with curiosity, apply critical thinking to AI-assisted work, and always prioritize accuracy, confidentiality, and ethical standards in how they use them.

Basic Qualifications

• Currently enrolled in and attending school, pursuing a Bachelor's or Master’s degree in Computer Science, Systems Engineering, Information Technology, Security or a related technical field with expected graduation by August 2027.

• Completion of the 2026 Lilly technology summer internship or spring fellowship.

Additional Skills & Preferences

• Prior experience using AI tools (e.g., generative AI platforms, automation tools, or AI-assisted research/analytics tools) in an academic, project, or work setting.

• Demonstrated experience in network operations or engineering and/or system administration, troubleshooting, or similar Information Technology related experience.

• Demonstrated experience and excellence in documentation skills.

• Experience working on Enterprise level cybersecurity detection and analysis.

• Experience with monitoring system operations and reacting to events in response to triggers and/or observation of trends or unusual activity.

• Ability to communicate complex technical issues to non-technical personnel.

• Demonstrated skills in:

  • Use of endpoint security tools to collect information for digital forensics and incident response efforts.

  • Use of strong investigatory principles to surface and pivot on information and insights that are material to a cyber investigation.

  • Auditing firewalls, perimeters, routers, and intrusion detection systems.

  • Relevant programming and query languages (e.g., PowerShell, bash, FQL, KQL, SPL, C++, Python, etc.).

  • Reverse engineering (e.g., software debugging, de-compilation of code, binary literacy, Windows OS internals) to identify function and capability of malicious code.

General knowledge of:

• Risk management processes (e.g., methods for assessing and mitigating risk).

• Current software and methodologies for active defense and system hardening.

• Netflow and raw network traffic data; foundational networking protocols such as IP, TCP, UDP, DNS, and HTTP.

• Malware – static and dynamic analysis techniques, detection methodologies and analysis techniques.

• Cloud technologies, cloud service models, resource pooling, authentication, and logging capabilities associated with major service providers.

• Laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.

• Certifications addressing new attack vectors (emphasis on cloud computing technology, mobile platforms, and tablet computers), new vulnerabilities, existing threats to operating environments, managing, maintaining, troubleshooting, installing, configuring basic network infrastructure.

• Prior experience using AI tools (e.g., generative AI platforms, automation tools, or AI-assisted research/analytics tools) in an academic, project, or work setting.

• Supporting: Assisting in various cybersecurity and other work as assigned.

• Analyzing: Examining cyber threats and incidents.

• Developing: Creating capability to enable each core function.

• Documenting: Thorough documentation of your analysis.

• Detecting: Identifying potential security issues.

• Prioritizing: Ranking threats based on severity.

• Responding: Taking action to mitigate threats.

• Recommending Strategic Changes: Drive security improvements that will increase our ability to defend the Enterprise.

• Provide rotational on-call availability for cybersecurity incidents raised outside of normal business working hours.

Additional Information

• As part of Lilly's commitment to innovation, interns will have the opportunity to build fluency with AI tools used across the business. We expect interns to approach these tools with curiosity, apply critical thinking to AI-assisted work, and always prioritize accuracy, confidentiality, and ethical standards in how they use them.

• This role is based at our Corporate Center in Indianapolis, IN. We offer a flexible hybrid work model, with three days onsite and two days working remotely each week, supporting both collaboration and work‑life balance. Some travel may be required.

• Qualified applicants must be authorized to work in the United States on a full-time basis. Lilly will not provide support for or sponsor work authorization or visas for this role, including but not limited to F-1 CPT, F-1 OPT, F-1 STEM OPT, J-1, H-1B, TN, O-1, E-3, H-1B1, or L-1.

Lilly is dedicated to helping individuals with disabilities to actively engage in the workforce, ensuring equal opportunities when vying for positions. If you require accommodation to submit a resume for a position at Lilly, please complete the accommodation request form () for further assistance. Please note this is for individuals to request an accommodation as part of the application process and any other correspondence will not receive a response.

Lilly is proud to be an EEO Employer and does not discriminate on the basis of age, race, color, religion, gender identity, sex, gender expression, sexual orientation, genetic information, ancestry, national origin, protected veteran status, disability, or any other legally protected status.

Our employee resource groups (ERGs) offer strong support networks for their members and are open to all employees. Our current groups include: Africa, Middle East, Central Asia (AMECA), Black Employees at Lilly (BE@Lilly), Chinese Culture Network (CCN), EnAble, Evolve, Lilly Indian Network (LIN), Organization of Latinx at Lilly (OLA), Pride (LGBTQ+ Allies), Veterans Leadership Network (VLN) and Women’s Initiative for Leading at Lilly (WILL).

Actual compensation will depend on a candidate’s education, experience, skills, and geographic location. The anticipated wage for this position is

$82,000 (Bachelors) - $100,000 (Masters)

Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance). In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities).Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly’s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees.

#WeAreLilly