Advisory PSIRT Engineer

About the role

Lenovo's Enterprise Product Security Incident Response Team (E-PSIRT) is looking for a Product Security Advisory Engineer who acts as the central operational orchestrator for vulnerability management across Lenovo's global product portfolio. The role coordinates product security offices, engineering teams and suppliers so that vulnerabilities are evaluated, remediated and disclosed, and supports Cyber Resilience Act (CRA) compliance, vulnerability reporting readiness and regulatory response.

Key responsibilities

• Evaluate vulnerabilities, exploits and incidents from researchers, threat intelligence, public disclosures and internal testing, assessing severity, risk and business impact.
• Manage the full lifecycle of vulnerability cases, from intake through investigation, remediation tracking and closure.
• Coordinate vulnerability response across product security offices, Legal and business groups.
• Work with suppliers, partners and security researchers to build remediation plans and coordinate responsible disclosures.
• Write, review and publish technical security advisories with fixes, workarounds and mitigations.
• Manage internal and customer messaging on critical vulnerabilities consistently and on time.
• Assist with CRA reporting by identifying exploited vulnerabilities, preparing regulatory reports and taking part in readiness exercises.
• Monitor vulnerability databases, threat feeds and third-party notifications to spot emerging risks.
• Develop vulnerability management metrics, drive triage automation and refine team playbooks, SOPs and governance.

Required profile

• Bachelor's degree in Cybersecurity, Information Systems, Systems Engineering, Law or a closely related technical discipline.
• 8+ years of applied experience in cybersecurity, software engineering, product security, enterprise risk or regulatory compliance, in a team-lead capacity.
• Proven ability in security operations, incident response, vulnerability analysis and/or threat intelligence.
• Prior hands-on experience in an enterprise PSIRT, with at least 2 years required.
• Exceptional written and verbal communication with technical teams, senior leadership and external researchers.
• Availability for critical cycles with occasional off-hours work and intermittent travel for regulatory assessments.

Preferred requirements

• Experience engaging directly with external security researchers, CERTs, regulators and industry consortia.
• Experience handling AI-related vulnerabilities and modern machine learning platform incidents.

What we offer

• Career advancement and personal growth opportunities.
• A range of training programs.
• Performance-based rewards.