Sr Manager Cloud Security Operations

Why Work at Lenovo:
At Lenovo, we believe in smarter technology for all, building a society that's brighter and more inclusive. We are one of Fortune's Most Admired companies, operating in 180 countries with 63,000 colleagues.

By designing, engineering, and building the world's most complete portfolio of smart devices and infrastructure, we are also leading an Intelligent Transformation—creating better experiences and opportunities for millions of customers around the world. Join us in defining our world of tomorrow and creating smarter technology for all!

This position is for a Cloud Product SOC Manager in the Security Center of Excellence for PC and Smart Devices business (PCSD). It is an exciting role working with a global team of development engineers and security professionals to assess and secure Lenovo applications and devices. You will work with multiple development teams across Lenovo to ensure secure development practices are followed, as well as working with security champions to review applications preinstalled on Lenovo devices.

The role is based in Brazil and is responsible for ensuring Lenovo's PCSD diverse product portfolio is designed, developed, delivered and operated securely.

• Oversee the Lenovo Cloud Product SOC and coordinate all activities to include 24x7x365 security monitoring and defense of Lenovo Cloud Products
• Manage technical delivery and continual process and procedure improvement to drive operational excellence
• Develop workflows and integration points across all Lenovo Security Teams
• Coordinate with third‑party vendors and partners to ensure effective operational delivery of services and technologies
• Supervise the development of detection use cases based on available log sources
• Serve as technical expert and liaison to law enforcement personnel and explain incident details as needed
• Coordinate with intelligence analysts to correlate threat assessment data.
• Write and publish after‑action reviews
• Ensure that cybersecurity‑enabled products or other compensating security control technologies reduce identified risk to an acceptable level
• Perform security reviews and identify security gaps in security architecture resulting in recommendations for inclusion in the risk mitigation strategy
• Plan and recommend modifications or adjustments based on exercise results or system environment
• Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization’s cyber incident response plan
• Analyze and report organizational security posture trends
• Analyze and report system security posture trends
• Provides cybersecurity recommendations to leadership based on significant threats and vulnerabilities
• Work with stakeholders to resolve computer security incidents and oversee vulnerability remediation compliance
• Provide advice and input for Disaster Recovery, Contingency, and Continuity of Operations Plans
• Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources
• Coordinate with enterprise‑wide cyber defense staff to validate network alerts
• Document and elevate incidents (including event's history, status, and potential impact) that may cause ongoing and immediate impact to the environment
• Perform cyber defense trend analysis and reporting
• Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack
• Provide weekly/monthly reports of network events and activity relevant to cyber defense practices
• Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts
• Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities
• Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity
• Analyze…