We are Lenovo

We do what we say. We own what we do. We WOW our customers.

Lenovo is a US$83 billion revenue global technology powerhouse, ranked #153 in the Fortune Global 500, and serving millions of customers every day in 180 markets. Focused on a bold vision to deliver Smarter Technology for All, Lenovo has built on its success as the world’s largest PC company with a full-stack portfolio of AI-enabled, AI-ready, and AI-optimized devices (PCs, workstations, smartphones, tablets), infrastructure (server, storage, edge, high performance computing and software defined infrastructure), software, solutions, and services. Lenovo’s continued investment in world-changing innovation is building a more equitable, trustworthy, and smarter future for everyone, everywhere. Lenovo is listed on the Hong Kong stock exchange under Lenovo Group Limited (HKSE: 992) (ADR: LNVGY).

This transformation together with Lenovo’s world-changing innovation is building a more inclusive, trustworthy, and smarter future for everyone, everywhere. To find out more visit www.lenovo.com, and read about the latest news via our StoryHub.

Product Security Advisory Engineer

The Product Security Advisory Engineer within Lenovo’s Enterprise Product Security Incident Response Team (E-PSIRT) is the central operational orchestrator for vulnerability management across Lenovo’s global product portfolio. This critical role coordinates product security offices, engineering teams, and suppliers to ensure vulnerabilities are appropriately evaluated, remediated, and disclosed. Additionally, this position plays a pivotal role in supporting Lenovo’s Cyber Resilience Act (CRA) compliance, vulnerability reporting readiness, and regulatory response activities.

Key Responsibilities

• Vulnerability Assessment Triage: Evaluate product security vulnerabilities, exploits, and incidents from external researchers, threat intelligence, public disclosures, and internal testing to determine severity, risk, and business impact.
• PSIRT Case Management: Manage the end-to-end lifecycle of vulnerability cases from initial intake through technical investigation, remediation progress tracking, and final closure.
• Central Operational Orchestration: Coordinate cross-functional vulnerability response efforts across internal product security offices (IDG, ISG, SSG, Motorola, CAIO), Legal, and various business groups.
• Supplier Partner Liaison: Collaborate and negotiate with third-party upstream and downstream suppliers, technology partners, and security researchers to develop remediation plans and coordinate responsible disclosures.
• Security Advisory Development: Author, review, and publish technical security advisories communicating available fixes, workarounds, and mitigation strategies to customers.
• Cross-Functional Communication: Manage internal and customer-facing messaging to ensure accurate, consistent, and timely communication regarding critical vulnerabilities and product security issues.
• Cyber Resilience Act (CRA) Compliance: Assist with CRA reporting requirements by identifying actively exploited vulnerabilities or severe incidents, preparing regulatory reports, and participating in readiness exercises.
• Threat Intelligence Monitoring: Monitor global vulnerability databases, threat feeds, and third-party notifications to proactively assess emerging risks impacting Lenovo products.
• Metrics Continuous Improvement: Develop vulnerability management metrics, drive triage automation initiatives, and contribute to the refinement of team playbooks, SOPs, and governance documentation.