Cyber Legal Counsel, EU

The Cyber Legal Counsel will provide substantive legal support for Lenovo’s implementation of, and ongoing operational processes supporting compliance with, the EU Cyber Resilience Act (CRA). The role will focus on legal interpretation, regulatory reporting, interactions with regulators and law enforcement authorities, product classification and other complex CRA matters. The role will sit within the Global Privacy & Data Protection Legal team and work closely with Security, Product, Regulatory Compliance, Legal and other stakeholders. It will provide practical, business-oriented legal advice and help establish a consistent CRA legal framework across Lenovo’s products and entities. Key Responsibilities: Provide legal advice and sign-off on CRA incident and vulnerability reporting, product classification and other complex CRA matters. Monitor developments in CRA legislation, guidance, standards and regulatory practice, updating existing guidance or developing new policies and decision frameworks as needed. Support interactions with regulators and law enforcement authorities, including preparing legal assessments, responses and regulatory filings. Advise on complex or borderline questions concerning product classification, economic operators and CRA applicability. Support regulatory inquiries, complaints and investigations, coordinating responses with relevant internal stakeholders. Monitor CRA implementation across relevant business and Legal teams, identifying areas requiring further legal analysis, guidance or remediation. Provide legal input into Product Security training, tabletop exercises and other CRA readiness activities. Coordinate with external counsel on specialised legal matters and escalate significant legal risks, novel interpretations and high-risk issues to the Lead Senior Counsel, Cybersecurity. Key

Law degree and qualification to practise law in the EU/EEA. 8+ years’ experience in technology, cybersecurity, product regulation, privacy and/or digital regulation. Strong experience advising on EU regulatory requirements and translating complex legal obligations into practical business processes. Strong interest in or experience with cybersecurity, software, hardware, connected products or digital technologies. Ability to analyse complex regulatory questions and provide clear, commercially focused advice. Experience advising senior stakeholders and working across multiple business units and jurisdictions. Strong written and verbal communication skills in English. Preferred Experience: Direct experience advising on the CRA, NIS2, product security, cybersecurity, EU product laws or other digital regulatory requirements. Experience with product classification, conformity assessment, CE marking, market surveillance, cybersecurity incident and vulnerability reporting, or regulatory interactions and investigations. Experience interpreting developing or ambiguous regulatory requirements and working with external counsel on complex matters, ideally within a multinational technology manufacturer or global organisation supporting hardware, software or connected products. What Lenovo Can Offer You: Private Medical Insurance Pension Plan Life Assurance Income Protection Cycle to Work 23 days holiday, increasing with years of service