This role will act as the primary orchestrator across a multitude of teams to ensure consistent vulnerability handling, incident response, threat intelligence and compliance with global regulatory requirements, including the EU Cyber Resilience Act (CRA).

Key Responsibilities:

• Product Security Governance: Establish and manage Lenovo’s Global Enterprise Product Security Governance framework

• Establish enterprise tools, standards, policies, procedures, KPIs, and reporting for Enterprise-level PSIRT
• Drive alignment across Product Security Offices within IDG, ISG, SSG, Motorola, CAIO, Legal, and other business groups

• Program Oversight

• Serve as the central orchestration lead for product security vulnerabilities, including AI and related security incidents
• Coordinate enterprise-wide vulnerability response activities across business group security and engineering teams
• Facilitate triage, prioritization, remediation, escalation, communication, and disclosure decision-making processes
• Oversee tooling, automation, and process improvements to support scale and efficiency

• Cyber Resilience Act Leadership

• Lead Lenovo’s operational readiness and execution of CRA Article 14 requirements
• Maintain and Improve governance processes for:
• Actively Exploited Vulnerability Reporting
• Serve Incident Reporting
• ENISA notification workflows
• Regulatory evidence retention
• Coordinated Vulnerability Disclosure (CVD) requirements
• Lead CRA readiness including tabletop exercises

• Oversee Daily Operations

• Lead vulnerability disclosure and coordinated remediation efforts with internal stakeholders, suppliers, partners, and security researchers
• Drive end-to-end security advisory development, including vulnerability tirage, risk assessment, mitigation guidance, and customer communications
• Manage communications with third-party suppliers and researchers to facilitate timely vulnerability resolution and responsible disclosure
• Publish and maintain customer-facing security advisories, ensuring clear, accurate, and actionable remediation guidance
• Partner with engineering, legal, communications, and support organizations to coordinate response activities and ensure consistent stakeholder communications throughout the vulnerability lifecycle

Qualifications:

• Bachelor’s degree in Cybersecurity, Information Systems, Systems Engineering, or a highly related technical discipline preferred
• 10+ years of applied experience in cybersecurity, product security, incident response, threat intelligence, or related program management/functional roles
• Proven capability in establishing and leading a technical cybersecurity program in vulnerability management, incident response, or threat intelligence
• Hands-on technical leader with ability to manage complex, multi-stakeholder initiatives
• Exceptional written and verbal communication skills; Capable of bridging the lexicon gap between legal, engineering, and executive stakeholders
• Availability to support critical cycles during business hours with occasional off-hours engagement; Intermittent travel may be required for regulatory assessments and stakeholder alignment
• Previous PSIRT leadership experience
• Experience interacting with external researchers, CERTs, regulators, and industry consortiums
• Experience handling AI-related vulnerabilities and/or incidents
• Active professional credentials such as CISSP, CISM, CISA, or ISO related certifications