Cybersecurity Incident Response Engineer

We AreSynopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products. We deliver industry-leading silicon design, IP, simulation and analysis solutions, and design services. We partner closely with our customers across a wide range of industries to maximize their R&D capability and productivity, powering innovation today that ignites the ingenuity of tomorrow.

Is your CV ready If so, and you are confident this is the role for you, make sure to apply asap.
You AreYou have spent years investigating security incidents that actually matter, the kind where determining scope quickly and containing the threat correctly makes the difference between a contained event and a company-wide problem. When something breaks at 2 a.m., you are the person who can walk into the chaos, figure out what happened, coordinate the response, and keep the investigation moving forward without losing critical details.You know how to work an active incident alongside third-party forensics teams, detection engineers, and threat intelligence analysts without stepping on toes or losing momentum. Between incidents, you do not sit idle. You help deploy new security tools, write detections that actually catch things, and architect capabilities the team has not used before. Learning a new platform or standing up a new security capability does not intimidate you because you have done it before and you know how to ask the right questions.Working across time zones is normal for you. You understand that incident response is unpredictable and you are comfortable with that reality. At Synopsys, you will join a globally dispersed CSIRT team where the work you do during high-criticality investigations protects the infrastructure that powers semiconductor innovation worldwide.
What You'll Be DoingInvestigate high-criticality cybersecurity incidents from detection through containment, determining scope and coordinating response activities across global teamsWork directly with third-party forensic providers during significant investigations, managing handoffs and ensuring continuity across time zonesCollaborate with Detection Engineering and Threat Intelligence to improve alert quality, enrich detections, and close feedback loops based on investigation findingsDeploy new security tools and capabilities across endpoint, cloud, and email security environments, including platforms like CrowdStrike, Wiz, Proofpoint, and AbnormalDevelop and tune security detections that reduce noise and catch real threats, contributing to the team's detection library and response playbooksCoordinate incident response activities with teams outside cybersecurity during major investigations, translating technical findings into actionable guidanceArchitect and implement security solutions the team has not previously used, including emerging AI-related security tooling
The Impact You Will HaveStrengthen East Coast incident response coverage, enabling the global CSIRT team to operate effectively across time zones with a true follow-the-sun modelReduce time to containment during high-criticality incidents by bringing senior-level investigative capability and cross-functional coordination to active response effortsImprove detection quality and reduce alert fatigue by feeding investigation findings back into detection engineering and enriching alerts with contextual intelligenceExpand the security program's capability by deploying new tools, standing up new security functions, and helping the team adopt technologies they have not used beforeProtect Synopsys infrastructure and intellectual property by investigating incidents that could affect how 30,000 employees work and how customers depend on our productsBuild institutional knowledge by documenting investigations, creating playbooks, and mentoring team members in other geographiesAccelerate security projects between incidents, ensuring the team continuously improves its tooling, detections, and response capabilities rather than staying reactive
What You'll Need7+ years of hands-on cybersecurity investigation and incident response experience, including leading or significantly contributing to high-criticality incident investigationsStrong experience investigating active security incidents where determining scope, coordinating containment, and managing cross-functional response were criticalDemonstrated ability to work within a formal incident response plan and collaborate effectively with multidisciplinary response teams during live incidentsExperience working with third-party cybersecurity or forensics providers during investigations, including managing handoffs and coordinating across organizationsProven ability to collaborate with Detection Engineering and Threat Intelligence functions to improve detections, enrich alerts, and close feedback loopsExperience contributing to security projects outside incident response, such as deploying new security tools, developing detections, or standing up new capabilitiesExposure to endpoint security, cloud security, and email security technologies; experience with CrowdStrike, Wiz, Proofpoint, or Abnormal is a plusSecurity automation experience or familiarity with Microsoft Power Automate is a plus
Who You AreYou can walk into an active incident at any hour, assess what is happening, and start moving the investigation forward without needing perfect information or a detailed briefYou are comfortable coordinating across time zones during incidents, which means occasionally working different hoursYou can explain a complex security incident to a non-technical stakeholder in two sentences without losing the technical nuance that matters for decision-makingYou move effectively between two modes of work: reactive incident investigation when something is on fire, and proactive security projects when things are quietYou push back when a detection is too noisy, a tool deployment plan is missing a critical step, or an incident response process is not going to work in practiceYou learn new security platforms quickly because you have architected and deployed tools before, and you know how to ask vendors and colleagues the right questions to get up to speed
The Team You'll Be Part OfYou will join the global CSIRT team, which is distributed across Chile, Bangalore, Ireland, and the U.S. East and West Coasts. The largest concentration of team members is in Bangalore. The team balances two primary areas of focus: responding to high-criticality cybersecurity incidents and investigations, and working on security projects and capability development between incidents, including implementing tools, creating detections, and standing up new security capabilities.
Rewards and BenefitsWe offer a comprehensive range of health, wellness, and financial benefits to cater to your needs. Our total rewards include both monetary and non-monetary offerings. xzbcwsv Your recruiter will provide more details about the salary range and benefits during the hiring process.