Cyber Legal Program Manager

About the role

Lenovo's Cyber Legal Programme Manager coordinates the processes needed for Lenovo's global implementation of the EU Cyber Resilience Act (CRA), focusing on end-to-end legal reporting and regulatory filings arising from CRA vulnerability reporting and incident obligations. Working within the Global Privacy Data Protection Legal team and closely with Security, Regulatory Compliance, other Legal teams and stakeholders, the role ensures CRA reporting is operational, consistently applied and completed within regulatory deadlines across Lenovo Group and Motorola Mobility. It is a highly cross-functional role requiring strong programme management skills and a good understanding of cybersecurity regulatory requirements and legal processes; deep substantive legal expertise is not required.

Key responsibilities

• Coordinate the day-to-day CRA legal workstream and end-to-end reporting workflows under the direction of the Lead Senior Counsel, Cybersecurity.
• Track regulatory deadlines, legal reviews, approvals, filings, follow-up actions and outstanding issues, escalating risks or delays as needed.
• Coordinate inputs from Legal, Security, Regulatory Compliance, Product Security, Engineering and business units to support timely legal assessments and filings.
• Maintain CRA reporting procedures, playbooks, templates, trackers, evidence and supporting documentation.
• Support the implementation, testing and readiness of CRA escalation and reporting processes, including tabletop exercises.
• Coordinate regulatory inquiries, authority requests and follow-up actions across internal stakeholders.
• Support external counsel engagement, including matter coordination, timelines, deliverables and budget tracking.
• Prepare regular status updates and reporting materials for the Lead Senior Counsel and Legal stakeholders.

Required profile

• Extensive background in legal, compliance, risk, cybersecurity or technology environments.
• At least 8 years of programme or project management experience in a legal, regulatory, cybersecurity or technology environment.
• Experience coordinating complex, cross-functional regulatory or compliance programmes, preferably in a multinational technology, hardware, software or product-driven organisation.
• Strong understanding of legal review, approval and regulatory reporting processes, including time-sensitive workflows, escalations and supporting documentation.
• Ability to manage multiple workstreams and stakeholders against tight, legally mandated deadlines, with strong organisational, communication and stakeholder-management skills.
• Ability to work across Legal, Product Security, Engineering, Security Operations and business teams, with strong written and spoken English.
• A law degree is an advantage; familiarity with cybersecurity incident response, vulnerability management, process governance and regulatory readiness is also beneficial.

Required skills

• Working knowledge of cybersecurity and product-security regulatory requirements; experience with the EU Cyber Resilience Act (CRA), NIS2 or similar EU digital regulations strongly preferred.
• Programme management and stakeholder coordination.

What we offer

• Career development and growth opportunities.
• Performance-based rewards.
• Hybrid working model (office 3 days, home office 2 days a week).
• Up to three paid personal days annually, plus additional vacation days.
• 100% sick leave compensation for up to two months per year.
• Soft and hard skills training, plus individual mentoring.
• Employer contribution to the Third Pillar pension system, and life and life-events insurance fully covered by the company.