Cybersecurity Incident Response Engineer, Senior Staff

Descriptions & Requirements

Job Description and Requirements

We Are

Synopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products. We deliver industry-leading silicon design, IP, simulation and analysis solutions, and design services. We partner closely with our customers across a wide range of industries to maximize their R&D capability and productivity, powering innovation today that ignites the ingenuity of tomorrow.

You Are

You are an experienced cybersecurity professional with a strong background in incident response and security operations. You have hands-on experience investigating significant security incidents where quickly determining scope, coordinating containment, and maintaining investigation momentum are critical.

You are comfortable working with third-party forensic providers, Detection Engineering, Threat Intelligence, and teams outside cybersecurity during active investigations. Between incidents, you contribute to improving security capabilities by developing detections, deploying new security tools, improving processes, and supporting new security initiatives.

You have a strong technical foundation across endpoint, network, cloud, and email security environments and can correlate and analyze information from multiple data sources to investigate threats and determine their impact. You are comfortable learning new technologies, communicating complex security issues to different audiences, and working across time zones as part of a globally distributed incident response team.

What You'll Be Doing

Investigate high-severity cybersecurity incidents from detection through containment, determining scope and coordinating response activities across global teams

Work directly with third-party cybersecurity and forensic providers during significant investigations, managing handoffs and maintaining continuity across teams and time zones

Correlate and analyze data across multiple log sources, systems, and security technologies to investigate incidents and determine potential impact

Collaborate with Detection Engineering and Threat Intelligence to improve alert quality, enrich detections, reduce unnecessary noise, and apply lessons learned from investigations

Develop and tune security detections and contribute to the team's detection library, incident response procedures, documentation, and playbooks

Deploy and support new security tools and capabilities across endpoint, cloud, and email security environments, including technologies such as CrowdStrike, Wiz, Proofpoint, and Abnormal

Coordinate incident response activities with teams outside cybersecurity during major investigations and translate technical findings into clear, actionable guidance

Contribute to security projects between incidents, including implementing new tools, developing automation, and establishing new security capabilities

Stay current with evolving cyber threats and assess how emerging threats could affect the environment

Leverage AI technologies, including LLM and agentic solutions, to improve security operations and help address alert scale

The Impact You'll Have

Strengthen East Coast incident response coverage

Reduce time to containment during high-severity incidents through strong investigative capability and cross-functional coordination

Improve detection quality and reduce alert fatigue by feeding investigation findings back into Detection Engineering and enriching alerts with relevant context

Expand the security program's capabilities through new tools, detections, automation, and security initiatives

Help protect Synopsys infrastructure and intellectual property through effective investigation and response to cybersecurity incidents

Build institutional knowledge by documenting investigations, strengthening response procedures and playbooks, and sharing knowledge across the globally distributed team

Support continuous improvement of tooling, detections, processes, and response capabilities between active incidents

What You'll Need

5+ years of hands-on cybersecurity experience in Incident Response, Security Operations, or a related security function, including significant experience investigating cybersecurity incidents

Strong experience investigating active security incidents, including determining scope, coordinating containment, and working with multidisciplinary teams during response

Experience working within formal incident response processes and coordinating activities across technical and business teams

Experience collaborating with third-party cybersecurity or forensic providers during investigations

Hands-on experience with SIEM and endpoint detection and response technologies, with the ability to investigate and correlate security activity across multiple data sources

Strong log analysis and network analysis skills with the ability to correlate information across systems and security technologies during investigations

Strong technical knowledge of common network protocols and technologies, including TCP/IP, HTTPS, FTP, SFTP, SSH, RDP, CIFS/SMB, and NFS

Familiarity with cloud and SaaS environments, including AWS, Azure, and Microsoft 365

Strong understanding of Windows environments and general knowledge of Unix, Linux, and macOS

Understanding of MITRE ATT&CK and the NIST Cybersecurity Framework and how they apply within an enterprise environment

Practical experience with at least 1 development or scripting language, such as PowerShell, Python, or .NET, as well as regular expressions

Experience contributing to security initiatives outside active incident response, such as developing detections, deploying security tools, automating processes, or establishing new capabilities

Strong written and verbal communication skills, with the ability to explain complex security issues clearly to technical and nontechnical stakeholders

Experience with endpoint, cloud, and email security technologies such as CrowdStrike, Wiz, Proofpoint, or Abnormal is a plus

Experience with security automation and orchestration technologies, including Microsoft Power Automate or comparable platforms, is a plus

Experience applying AI technologies, including LLM and agentic solutions, within security operations is a plus

Relevant security certifications such as GCIH, GCFE, GCFA, GCSA, GMON, CISSP, or similar are a plus

Bachelor's degree in Information Security, Computer Science, or a related discipline, or an equivalent combination of education, training, and experience

The Team You'll Be Part Of

You will join the global CSIRT team, which is distributed across Chile, Bangalore, Ireland, and the U.S. East and West Coasts, with the largest concentration of team members in Bangalore. The team balances two primary areas of focus: responding to high-severity cybersecurity incidents and investigations, and advancing security projects and capabilities between incidents, including implementing tools, creating detections, improving automation, and establishing new security capabilities.

#LI-Hybrid

At Synopsys, we want talented people of every background to feel valued and supported to do their best work. Synopsys considers all applicants for employment without regard to race, color, religion, national origin, gender, sexual orientation, age, military veteran status, or disability.

In addition to the base salary, this role may be eligible for an annual bonus, equity, and other discretionary bonuses. Synopsys offers comprehensive health, wellness, and financial benefits as part of a competitive total rewards package. The actual compensation offered will be based on a number of job-related factors, including location, skills, experience, and education. Your recruiter can share more specific details on the total rewards package upon request. The base salary range for this role is across the U.S.