Senior Manager, AI Risk Management

Summary

The Senior Manager AI Risk Management will lead the new AI Risk Management organization in Lenovo's Chief AI Office and further our mission of enabling security and trust through Responsible AI. The AI Risk Management organization is part of the broader multi-discipline AI Governance function in the Chief AI Office, and will lead efforts to operationalize global AI governance regulations and customer requirements into the product and software development lifecycle.

The candidate should be an experienced governance, risk, compliance, and security professional with a strong background in building risk management and control programs across complex technology environments. This role will develop the CAIO AI risk management methodologies, governance processes and assurance capabilities that integrate AI risk management throughout the AI lifecycle. They will partner with AI Security, Product Engineering, AI Legal, Privacy, Internal Audit and business leadership to ensure AI risks are understood, appropriately managed and transparently reported to executive stakeholders.This person must be a strategic thinker with both leadership capability and deep expertise in AI, cybersecurity and product security. The candidate should understand the governance and security considerations associated with AI systems and software supply chains, including large language models, agentic AI, commercial offerings, third-party AI platforms, and emerging regulatory expectations. The ideal candidate can translate AI and security policy, certification, and customer assurance requirements into practical and repeatable operating models, lead AI risk and compliance assessments, and help demonstrate that Lenovo's AI systems are secure, trustworthy, well-governed, and aligned with internal standards, industry frameworks, and evolving global regulations.

Key Responsibilities:

• Lead Lenovo CAIO AI risk management program and governance assurance activities throughout the AI and product lifecycle, ensuring appropriate review, approval, documentation, monitoring, and escalation processes are followed.
• Operationalize AI governance policies, standards, and control frameworks across AI systems, products, services, internal AI tools, and AI-enabled business processes.
• Develop AI risk taxonomies, risk appetite statements, risk assessment methodologies, control objectives and risk acceptance criteria aligned with Lenovo enterprise risk management practices. Lead AI risk assessments for products, internal AI solutions, foundation models, third-party AI services and AI-enabled business processes to identify operational, security, privacy, compliance, ethical and business risks.
• Define key risk indicators (KRIs), risk metrics, and dashboards that provide executive visibility into Lenovo's AI risk posture, emerging risks, and control effectiveness.
• Support Lenovo's readiness for AI-related industry certifications, audits, customer assessments, and regulatory inquiries, including evidence collection, control mapping, gap tracking, and remediation planning.
• Partner with AI Security, AI Privacy, AI Legal, Product Security, Third-Party Risk, Internal Audit, and Engineering teams to ensure appropriate mitigation strategies are incorporated into product development and operational processes.
• Support enterprise AI incident management by assessing business impact, coordinating risk evaluation, recommending mitigation actions, and identifying opportunities to strengthen governance and controls. Present AI risk assessments, emerging risk trends, mitigation strategies, and program maturity to executive leadership and governance committees.
• Build and develop a high-performing AI Risk Management team while fostering a culture of proactive risk identification and informed decision-making across the enterprise.
• Occasional domestic and international travel (approximately 5-20%) for meetings and collaboration.

Basic Requirements:

• Bachelor's degree in Cybersecurity, Information Systems, Risk Management, Audit, Law, Data Privacy, Public Policy, Business, Computer Science, or a related discipline (or equivalent experience).
• 12+ years of experience in cybersecurity, technology governance, risk management, compliance, audit, third-party risk, security assurance, or related fields.

• Experience leading governance, risk, compliance, security assurance, audit readiness, or technology risk reviews involving complex enterprise technology initiatives.
• Experience designing and implementing enterprise risk assessment methodologies, including control frameworks, risk registers, key risk indicators (KRIs), executive reporting and continuous monitoring.
• Experience working with cross-functional stakeholders including Engineering, Product Management, Security, Legal, Privacy, Compliance, Supply Chain, Third-Party Risk, Internal Audit, and business leadership.
• Preferred experience conducting AI use case reviews, Responsible AI assessments, AI risk assessments, control assessments, or customer assurance reviews.
• Excellent understanding of Responsible AI frameworks and global AI regulations, including the EU AI Act, ISO/IEC 42001, ISO/IEC 27001, NIST AI RMF, OECD AI Principles, or similar governance and assurance frameworks.
• Experience leading certification readiness, internal or external audits, compliance gap assessments, control mapping, evidence collection, remediation tracking, or management reporting.
• Excellent understanding of third-party risk management, supplier assurance, AI vendor reviews, customer security questionnaires, and contractual security or compliance obligations.
• Good understanding of data protection regulations, including GDPR and privacy-by-design principles, as they apply to AI systems and AI-enabled services.
• Awareness of AI security frameworks and guidance such as OWASP Top 10 for LLM Applications, MITRE ATLAS, SAIF, or similar resources, with the ability to apply them in governance and assurance contexts.
• Professional certifications such as CISSP, CISM, CRISC, CISA, CDPSE, CTPRP, AAISM, ISO 27001 or ISO/IEC 42001 Lead Implementer/Auditor, AIGP, or similar are advantageous.
• Excellent written and verbal communication skills, with the ability to translate technical, regulatory, audit, and assurance topics into clear guidance for technical teams, business leaders, customers, and executives.