Vulnerability Management Analyst — Semiconductor IP

Job Description and Requirements

Vulnerability Management Analyst - Semiconductor IP

We Are:

At Synopsys, we drive the innovations that shape the way we live and connect. Our technology is central to the Era of Pervasive Intelligence, from self-driving cars to learning machines. We lead in chip design, verification, and IP integration, empowering the creation of high-performance silicon chips and software content. Join us to transform the future through continuous technological innovation.

You Are:

You are someone who builds trust with product and engineering teams when the topic is risk. You listen first, explain complex findings in clear language, and own your conclusions. You help people understand what a vulnerability means for their work and what they should do next.

You are practical when information is incomplete. You stay focused on timely action, challenge unclear choices in a respectful way, and keep looking for better ways to reduce risk. You care about teamwork, follow-through, and leaving guidance that others can use.

This is a full-time role.

What You’ll Be Doing:

- Analyze vulnerabilities affecting semiconductor IP products, firmware, and related interfaces, and determine residual risk with clear assumptions.
- Prioritize findings so product teams can act in a timely way: severity, exploitability, affected assets, and recommended mitigations.
- Work with design, verification, firmware, and product teams to explain vulnerabilities, walk through impact, and agree how the team will mitigate.
- Advise those teams on practical mitigations, compensating controls, and verification or test evidence that shows the risk is reduced.
- Work in semiconductor IP development and associated test flows, using the tools those teams use to design, verify, and test IP, so analysis matches how the product is actually built .
- Build and maintain your own analysis, intake, scoring, and reporting tools, including in Python, when existing tools are not enough. Scripts and tools should be readable and usable by other analysts.
- Track open risk through the cybersecurity lifecycle, from intake through analysis, treatment, verification, and internal release decisions, and keep status current.
- Facilitate working sessions so similar IP classes get consistent analysis, risk language, and mitigation guidance.
- Look for new and practical ways to detect, assess, and mitigate risk, including improved methods, automation, and lessons from prior findings.
- Use agentic workflows (AI agents, structured prompts, and human-in-the-loop review) to speed research and first drafts without handing off ownership of risk conclusions.
- Run the job in Jira, Confluence, Git, and GitLab : track vulnerability and risk work, keep documentation current, and version work products through review.

The Impact You Will Have:

- Give product teams vulnerability analysis and risk determinations they can trust and act on without re-deriving the work.
- Reduce time-to-mitigation by explaining findings clearly and agreeing practical next steps with the teams that own the product.
- Leave mitigation and test guidance that design, verification, and firmware teams can execute.
- Keep residual risk visible and current so internal release and treatment decisions are based on evidence, not stale status.
- Improve consistency of vulnerability handling and risk language across similar IP classes.
- Raise the quality of risk reduction over time by bringing new methods, better mitigations, and fit-for-purpose tools into the workflow.

What You’ll Need:

- Bachelor’s degree in electrical engineering, computer engineering, computer science, cybersecurity, or a related field, or equivalent practical experience. An advanced degree is welcome, not required.
- Typically 3 or more years in vulnerability management, product cybersecurity, embedded security, or a closely related engineering role. Stronger evidence on vulnerability analysis and risk determination can offset fewer years. Title (Analyst or Senior Analyst) will match demonstrated depth.
- Strong practical experience in vulnerability analysis on real products, not only scanning or training exercises.
- Ability to determine risk: severity, exploitability, affected assets, likelihood, impact, and residual risk after proposed mitigations.
- Ability to explain vulnerabilities and recommended mitigations to engineering teams so they can act in a timely way.
- Working familiarity with semiconductor IP development and associated testing, including the tools used to design, verify, and test IP. Specific commercial tool names are not required.
- Ability to write and maintain your own tools, including in Python, for analysis, intake, scoring, and reporting when existing tools are not enough. This is not a software-engineering role. Tools should be readable and usable by other analysts.
- Experience working with incomplete information and stating assumptions when the end-system is not fully known.
- Experience applying a cybersecurity lifecycle across planning, design, implementation, verification, and internal release, including tracking open risk to closure.
- Hands-on understanding of embedded systems enough to reason about hardware-rooted and firmware vulnerabilities: SoC or MCU integration, firmware, interfaces, registers, boot and debug, and interconnects.
- Experience delivering analysis inside product-team cadence, including re-prioritizing when new findings or design changes arrive.
- Practical experience using AI agents and agentic workflows to speed research, drafting, and repetitive analysis, while keeping the human as owner of technical conclusions.

- Hands-on use of Jira, Confluence, Git, and GitLab (or an equivalent Git forge) for tickets, documentation, and review.
- Clear written and spoken English; able to lead technical sessions with geographically distributed teams.
- Working knowledge of common vulnerability scoring and handling practice (for example CVSS) is helpful, as is ISO/SAE 21434 or a comparable product-cybersecurity standard, digital design or verification background (including RTL), semiconductor IP product experience, or applied embedded cryptography.

Who You Are:

- You build trust with design and product teams and keep working relationships strong when the discussion is about risk.
- You own the technical conclusion. You do not hand off judgment to a scanner, a score, a tool, or the loudest voice in the room.
- You write and speak clearly so engineers can understand a vulnerability and how to mitigate it without you in the room.
- You work well with incomplete information, and you state assumptions instead of hiding them.
- You drive timely action. You keep risk visible until it is treated or accepted with a clear rationale.
- You challenge unclear practices in a respectful way and recommend mitigations teams can actually adopt.
- You keep learning. You look for new and practical ways to assess and reduce risk, not only the methods you already know.
- You are collaborative and non-disruptive with product teams, including when you need them to change course .
- You are structured and detail-oriented, and you keep evidence current as findings and designs change.

The Team You’ll Be A Part Of:

You will join the CySec Vulnerability Management Team that supports Synopsys semiconductor IP products. You work with IP product teams in their delivery cadence. You collaborate with digital, analog, mixed-signal, firmware, and verification engineers, and with cybersecurity architects, to analyze vulnerabilities, determine risk, and agree mitigations through the cybersecurity lifecycle. The team works across regions. Your written work products are used by internal product and engineering teams.

Rewards and Benefits:

We offer a comprehensive range of health, wellness, and financial benefits to cater to your needs. Our total rewards include both monetary and non-monetary offerings. Your recruiter will provide more details about the salary range and benefits during the hiring process.

At Synopsys, we want talented people of every background to feel valued and supported to do their best work. Synopsys considers all applicants for employment without regard to race, color, religion, national origin, gender, sexual orientation, age, military veteran status, or disability.