Cyber Intelligence Analyst

About the Company

Lilly is a global healthcare organization focused on creating medicines and improving health outcomes for people worldwide. The company is headquartered in Indianapolis, Indiana, and its teams work across research, medicine development, disease management, philanthropy, and volunteerism with a people-first mindset.

Eli Lilly Cork brings together more than 2,000 employees representing 60 nationalities and supports a range of business service areas such as Finance, Information Technology, Medical, and Clinical Trials. The Cork campus in Little Island includes flexible hybrid working arrangements, healthcare, pension and life assurance benefits, a subsidised canteen, an onsite gym, travel support, and parking on site. Colleagues also have access to internal people development support, educational assistance, and wellbeing initiatives designed to support the whole employee experience.

The organization places strong emphasis on diversity, equity, and inclusion. Its DEI framework includes EnAble, Age & Culture, LGBTQ+, and GIN-Gender Inclusion Network. Through EnAble and the Access Lilly initiative, the company works to ensure that both physical and digital spaces are accessible and inclusive for people with disabilities and those who support them.

Role Overview

This position sits within the Global Cyber Defense Operations team, which focuses on proactive defense through analysis, innovation, and collaboration. The team’s purpose is to unify detection, investigation, and response efforts that help protect Lilly’s ability to develop life-changing medicines.

The Cyber Intelligence Analyst will work in one or more functional areas including Attack Surface Management, Cyber Threat Intelligence, Detection and Automation Operations, Cyber Defense Readiness, External Threat Response, and Insider Threat Response. Most analysts start in External Threat Response, though assignment to other areas may depend on team needs, skills, and development priorities.

Core GCDO Functions

• External Threat Response: Handles monitoring, detection, investigation, and response for cybersecurity events and incidents.
• Attack Surface Management: Works to shrink enterprise exposure by finding, evaluating, and remediating vulnerabilities.
• Cyber Threat Intelligence: Produces, consumes, and shares threat intelligence across internal teams and external sources, while building awareness of threats, campaigns, and intrusion sets targeting Lilly.
• Cyber Defense Readiness: Coordinates major initiatives between GCDO, other cybersecurity teams, and business partners.
• Detection and Analysis Operations: Supports SecOps and DevOps for GCDO-owned capabilities, enabling event detection, monitoring, and ongoing improvement of detections.
• Internal Threat Response: Monitors, analyzes, and investigates cybersecurity incidents with a focus on the internal workforce.

Key Responsibilities

• Assist with cybersecurity-related work and other tasks as needed.
• Review cyber threats and incidents to determine what is happening and why.
• Help build and improve capabilities that support the team’s core functions.
• Create clear and complete documentation of findings and analysis.
• Identify possible security issues and watch for indicators of compromise.
• Rank threats according to severity and business impact.
• Take action to contain or reduce risk from identified threats.
• Suggest strategic security improvements that strengthen enterprise defense.
• Participate in rotating on-call coverage for incidents outside standard business hours.
• Be available on one weekend every four weeks, with Saturday and Sunday coverage of about 8 to 9 hours per day.
• Support public-holiday coverage when required through a rotating schedule.
• Receive a fixed daily on-call allowance paid monthly in arrears, plus additional hourly premiums for work completed during the on-call period, also paid monthly in arrears.

Required Experience and Skills

Candidates should have hands-on experience monitoring system operations and responding to events triggered by alerts, indicators, or unusual trends. They must also be able to explain complex technical issues clearly to non-technical audiences.

Useful technical capability includes using endpoint security tools for digital forensics and incident response, applying strong investigative methods to trace and pivot on relevant data, and auditing firewalls, perimeter devices, routers, and intrusion detection systems. The role also calls for comfort with programming and query languages such as PowerShell, bash, FQL, KQL, SPL, C++, and Python.

Additional technical exposure should include reverse engineering and malware analysis, risk assessment and mitigation, active defense and hardening techniques, network traffic analysis, cloud security concepts, and familiarity with cybersecurity/privacy laws, regulations, policies, and ethics. Knowledge of certifications related to new attack vectors, cloud and mobile technologies, vulnerabilities, and basic network infrastructure is also valuable.

For baseline qualifications, the role requires either at least 2 years of experience in network operations, network engineering, system administration, troubleshooting, or a similar IT function, or a bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field plus demonstrated excellence in documentation. Prior experience in enterprise-level cybersecurity detection and analysis is also required.

Additional Information

Some travel may be necessary for this position.

Accommodation and Equal Opportunity

Lilly supports candidates with disabilities and provides a process to request accommodation during the application stage. The company is an equal opportunity employer and does not discriminate on the basis of age, race, color, religion, gender, sexual orientation, gender identity, gender expression, national origin, protected veteran status, disability, or any other legally protected status.

Workplace Culture

The company invites applicants who are creative, innovative, and comfortable being themselves while contributing to a mission centered on defending patients, employees, and shareholders from cyber threats.

Employment Terms

This is a full-time onsite role based in Cork, County Cork, Ireland.