Sr. Program Manager, Enterprise Product Security Incident Response Team (E-PSIRT)

Lenovo is a global technology company serving customers across devices, infrastructure, software, solutions, and services. The Sr. Enterprise Product Security Incident Response Program Manager will lead Lenovo’s Global Enterprise PSIRT, coordinating vulnerability management, incident response, threat intelligence, regulatory compliance, and Cyber Resilience Act readiness across business groups. The role oversees governance, triage, disclosure, remediation, reporting, stakeholder communications, and security advisory processes.

Responsibilities:

• Product Security Governance: Establish and manage Lenovo’s Global Enterprise Product Security Governance framework
• Establish enterprise tools, standards, policies, procedures, KPIs, and reporting for Enterprise-level PSIRT
• Drive alignment across Product Security Offices within IDG, ISG, SSG, Motorola, CAIO, Legal, and other business groups
• Program Oversight
• Serve as the central orchestration lead for product security vulnerabilities, including AI and related security incidents
• Coordinate enterprise-wide vulnerability response activities across business group security and engineering teams
• Facilitate triage, prioritization, remediation, escalation, communication, and disclosure decision-making processes
• Oversee tooling, automation, and process improvements to support scale and efficiency
• Cyber Resilience Act Leadership
• Lead Lenovo’s operational readiness and execution of CRA Article 14 requirements
• Maintain and Improve governance processes for:
• Actively Exploited Vulnerability Reporting
• Serve Incident Reporting
• ENISA notification workflows
• Regulatory evidence retention
• Coordinated Vulnerability Disclosure (CVD) requirements
• Lead CRA readiness including tabletop exercises
• Oversee Daily Operations
• Lead vulnerability disclosure and coordinated remediation efforts with internal stakeholders, suppliers, partners, and security researchers
• Drive end-to-end security advisory development, including vulnerability tirage, risk assessment, mitigation guidance, and customer communications
• Manage communications with third-party suppliers and researchers to facilitate timely vulnerability resolution and responsible disclosure
• Publish and maintain customer-facing security advisories, ensuring clear, accurate, and actionable remediation guidance
• Partner with engineering, legal, communications, and support organizations to coordinate response activities and ensure consistent stakeholder communications throughout the vulnerability lifecycle

Requirements:

• • 10+ years of applied experience in cybersecurity, product security, incident response, threat intelligence, or related program management/functional roles
• • Proven capability in establishing and leading a technical cybersecurity program in vulnerability management, incident response, or threat intelligence
• • Hands-on technical leader with ability to manage complex, multi-stakeholder initiatives
• • Exceptional written and verbal communication skills; Capable of bridging the lexicon gap between legal, engineering, and executive stakeholders
• • Availability to support critical cycles during business hours with occasional off-hours engagement; Intermittent travel may be required for regulatory assessments and stakeholder alignment
• • Previous PSIRT leadership experience
• • Experience interacting with external researchers, CERTs, regulators, and industry consortiums
• • Experience handling AI-related vulnerabilities and/or incidents
• • Active professional credentials such as CISSP, CISM, CISA, or ISO related certifications
• • Bachelor's degree or equivalent experience
• • 10+ years of experience in cybersecurity, product security, incident response, threat intelligence, and/or program management
• • Bachelor's degree in Cybersecurity, Information Systems, Systems Engineering, or a highly related technical discipline preferred