Operational Security Manager

Why Work at Lenovo

We are Lenovo. We do what we say. We own what we do. We WOW our customers.

Lenovo is a US$83 billion revenue global technology powerhouse, ranked #153 in the Fortune Global 500, and serving millions of customers every day in 180 markets. Focused on a bold vision to deliver Smarter Technology for All, Lenovo has built on its success as the world’s largest PC company with a full-stack portfolio of AI-enabled, AI-ready, and AI-optimized devices (PCs, workstations, smartphones, tablets), infrastructure (server, storage, edge, high performance computing and software defined infrastructure), software, solutions, and services. Lenovo’s continued investment in world-changing innovation is building a more equitable, trustworthy, and smarter future for everyone, everywhere. Lenovo is listed on the Hong Kong stock exchange under Lenovo Group Limited (HKSE: 992) (ADR: LNVGY).

This transformation together with Lenovo’s world-changing innovation is building a more inclusive, trustworthy, and smarter future for everyone, everywhere. To find out more visit www.lenovo.com, and read about the latest news via our StoryHub.

Description and Requirements

This position is for an Operational Security Manager in the Solutions & Services Group (SSG).  This is an exciting role that will give you the opportunity to work with Lenovo Engineering teams around the world to help Lenovo Business Units align with various regional, national and international security standards and regulations. You will be working alongside some of the best security teams in the industry. You will join a growing team of security professionals to protect and maintain the effectiveness of managed service capabilities.

The Operational Security Manager supports cybersecurity incident response, investigation, escalation, and regulatory reporting, with a focus on the EU Cyber Resilience Act. Working across Cybersecurity, Product Security, Legal, Compliance, Privacy, and Engineering, this role ensures incidents are properly assessed, documented, and reported within required timelines. The Operational Security Manager also provides technical leadership and continuously improves security processes, controls, and supporting technologies.

What You'll Be Doing :

• Support the full cybersecurity incident response lifecycle, including triage, investigation, containment, escalation, remediation, recovery, and post-incident review across enterprise and product environments. 
• Coordinate incident response activities across Cybersecurity, Product Security, Engineering, IT, Legal, Compliance, Privacy, and external partners, including support for critical incidents outside normal business hours when necessary. 
• Assess incidents and actively exploited vulnerabilities affecting products marketed or sold in the EU to determine applicable handling and notification requirements, particularly under the EU Cyber Resilience Act. 
• Coordinate timely and accurate regulatory notifications, ensuring required incident, product, impact, mitigation, and remediation information is gathered, validated, documented, and communicated. 
• Maintain incident records, regulatory assessments, reporting decisions, evidence, and chain of custody in support of internal, legal, audit, and regulatory requirements. 
• Strengthen incident response readiness through playbooks, tabletop exercises, lessons learned, metrics, automation, and improvements to 
• monitoring and investigation capabilities. 

What You’ll Need:

• Significant experience leading cybersecurity incident response or security operations, with demonstrated knowledge of the full incident response lifecycle. 
• Experience investigating incidents across product, application, cloud, infrastructure, network, endpoint, and third-party environments. 
• Working knowledge of EU cybersecurity regulatory requirements, particularly the incident and actively exploited vulnerability notification requirements of the EU Cyber Resilience Act. 
• Strong understanding of threat and vulnerability analysis, digital forensics, evidence preservation, chain of custody, and technologies such as SIEM, endpoint security, threat intelligence, and vulnerability management platforms. 
• Ability to translate complex technical findings into clear incident assessments, escalation decisions, executive communications, and regulatory notifications. 
• Strong leadership, stakeholder management, communication, and decision-making skills, with the ability to manage high-pressure incidents and meet operational and regulatory deadlines. 

What We Offer:

• An international team with a high focus on Gender Diversity.​
• Employee Assistance Program, e.g., for psychological, legal & financial consultancy​
• You are joining a company that prioritizes sustainable solutions like CO2 Offset, Asset Recovery Services, and the Lenovo Certified Refurbished portfolio.​
• Access to training for personal development - Internal E-learning Development Platform Available for Employees ​
• Mentorship program

We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age, religion, sexual orientation, gender identity, national origin, status as a veteran, and basis of disability or any federal, state, or local protected class.

PAY TRANSPARENCY

If this role is primarily located outside the EU, the base salary range may not be listed in this posting. When the position can also be filled in EU countries, the applicable gross base salary range for the relevant EU location will be communicated to candidates well in advance of the interview process, in line with EU pay transparency obligations. Individuals may also be eligible for variable compensation (such as bonus or commission), and full details on total compensation and benefits for the applicable location will be shared during the recruitment process.

AI PROCESSING NOTICE

We use AI-based tools to support some of our processes (e.g. online interviews recordings and transcripts) in order to achieve better efficiency, accuracy and for our documentation purposes. AI can make mistakes, but we always make sure that the outputs are manually reviewed by a human. You can always opt-out or contact us in case of any question.