Operational Security Manager

Description and Requirements

• This position is for a n Operational Security Manager in the Solutions & Services Group (SSG). This is an exciting role that will give you the opportunity to work with Lenovo Engineering teams around the world to help Lenovo Business Units align with various regional, national and international security standards and regulations. You will be working alongside some of the best security teams in the industry. You will join a growing team of security professionals to protect and maintain the effectiveness of managed service capabilities.
• The Operational Security Manager supports cybersecurity incident response, investigation, escalation, and regulatory reporting, with a focus on the EU Cyber Resilience Act. Working across Cybersecurity, Product Security, Legal, Compliance, Privacy, and Engineering, this role ensures incidents are properly assessed, documented, and reported within required timelines. The Operational Security Manager also provides technical leadership and continuously improves security processes, controls, and supporting technologies.
• What You'll Be Doing :
• Support the full cybersecurity incident response lifecycle, including triage, investigation, containment, escalation, remediation, recovery, and post-incident review across enterprise and product environments.
• Coordinate incident response activities across Cybersecurity, Product Security, Engineering, IT, Legal, Compliance, Privacy, and external partners, including support for critical incidents outside normal business hours when necessary .
• Assess incidents and actively exploited vulnerabilities affecting products marketed or sold in the EU to determine applicable handling and notification requirements, particularly under the EU Cyber Resilience Act.
• Coordinate timely and accurate regulatory notifications, ensuring required incident, product, impact, mitigation, and remediation information is gathered, validated, documented, and communicated.
• Maintain incident records, regulatory assessments, reporting decisions, evidence, and chain of custody in support of internal, legal, audit, and regulatory requirements.
• Strengthen incident response readiness through playbooks, tabletop exercises, lessons learned, metrics, automation, and improvements to
• monitoring and investigation capabilities.