Cybersecurity Incident Response Engineer

Synopsys Inc; Raleigh (NC); On-site; USD 150,000 - 210,000; Full time

Job summary

Synopsys Inc seeks an experienced Senior Security Incident Responder to join a globally dispersed CSIRT team. You will lead investigations, coordinate containment, and partner with forensics and threat intelligence across time zones to protect critical infrastructure.

In this role you will deploy new tools, tune detections, and drive proactive security projects while translating complex findings into actionable guidance for stakeholders.

Qualifications

• 7+ years of hands-on cybersecurity investigation and incident response experience, including leading or significantly contributing to high-criticality incident investigations
• Experience investigating active security incidents with scope determination, containment coordination, and cross-functional response

Responsibilities

• Investigate high-criticality cybersecurity incidents from detection through containment, coordinating response across global teams
• Work with third-party forensic providers during significant investigations, manage handoffs and time-zone continuity
• Collaborate with Detection Engineering and Threat Intelligence to improve alert quality and enrich detections
• Deploy security tools and capabilities across endpoint, cloud, and email environments (CrowdStrike, Wiz, Proofpoint, Abnormal)
• Develop and tune detections to reduce noise and improve resilience of response playbooks
• Coordinate incident response activities with non-security teams during major investigations
• Architect and implement security solutions and tooling previously unused by the team

Skills

Incident response

Cross-functional teamwork

Threat intelligence

Detection engineering

Security automation

Power Automate

Vendor coordination

Tools

CrowdStrike

Wiz

Proofpoint

Abnormal

Job description

Synopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products. We deliver industry-leading silicon design, IP, simulation and analysis solutions, and design services. We partner closely with our customers across a wide range of industries to maximize their R&D capability and productivity, powering innovation today that ignites the ingenuity of tomorrow.

You Are

You have spent years investigating security incidents that actually matter, the kind where determining scope quickly and containing the threat correctly makes the difference between a contained event and a company-wide problem. When something breaks at 2 a.m., you are the person who can walk into the chaos, figure out what happened, coordinate the response, and keep the investigation moving forward without losing critical details.

You know how to work an active incident alongside third-party forensics teams, detection engineers, and threat intelligence analysts without stepping on toes or losing momentum. Between incidents, you do not sit idle. You help deploy new security tools, write detections that actually catch things, and architect capabilities the team has not used before. Learning a new platform or standing up a new security capability does not intimidate you because you have done it before and you know how to ask the right questions.

Working across time zones is normal for you. You understand that incident response is unpredictable and you are comfortable with that reality. At Synopsys, you will join a globally dispersed CSIRT team where the work you do during high-criticality investigations protects the infrastructure that powers semiconductor innovation worldwide.

What You'll Be Doing

• Investigate high-criticality cybersecurity incidents from detection through containment, determining scope and coordinating response activities across global teams
• Work directly with third-party forensic providers during significant investigations, managing handoffs and ensuring continuity across time zones
• Collaborate with Detection Engineering and Threat Intelligence to improve alert quality, enrich detections, and close feedback loops based on investigation findings
• Deploy new security tools and capabilities across endpoint, cloud, and email security environments, including platforms like CrowdStrike, Wiz, Proofpoint, and Abnormal
• Develop and tune security detections that reduce noise and catch real threats, contributing to the team's detection library and response playbooks
• Coordinate incident response activities with teams outside cybersecurity during major investigations, translating technical findings into actionable guidance
• Architect and implement security solutions the team has not previously used, including emerging AI-related security tooling

The Impact You Will Have

• Strengthen East Coast incident response coverage, enabling the global CSIRT team to operate effectively across time zones with a true follow-the-sun model
• Reduce time to containment during high-criticality incidents by bringing senior-level investigative capability and cross-functional coordination to active response efforts
• Improve detection quality and reduce alert fatigue by feeding investigation findings back into detection engineering and enriching alerts with contextual intelligence
• Expand the security program's capability by deploying new tools, standing up new security functions, and helping the team adopt technologies they have not used before
• Protect Synopsys infrastructure and intellectual property by investigating incidents that could affect how 30,000 employees work and how customers depend on our products
• Build institutional knowledge by documenting investigations, creating playbooks, and mentoring team members in other geographies
• Accelerate security projects between incidents, ensuring the team continuously improves its tooling, detections, and response capabilities rather than staying reactive

What You'll Need

• 7+ years of hands-on cybersecurity investigation and incident response experience, including leading or significantly contributing to high-criticality incident investigations
• Strong experience investigating active security incidents where determining scope, coordinating containment, and managing cross-functional response were critical
• Demonstrated ability to work within a formal incident response plan and collaborate effectively with multidisciplinary response teams during live incidents
• Experience working with third-party cybersecurity or forensics providers during investigations, including managing handoffs and coordinating across organizations
• Proven ability to collaborate with Detection Engineering and Threat Intelligence functions to improve detections, enrich alerts, and close feedback loops
• Experience contributing to security projects outside incident response, such as deploying new security tools, developing detections, or standing up new capabilities
• Exposure to endpoint security, cloud security, and email security technologies; experience with CrowdStrike, Wiz, Proofpoint, or Abnormal is a plus
• Security automation experience or familiarity with Microsoft Power Automate is a plus

Who You Are

• You can walk into an active incident at any hour, assess what is happening, and start moving the investigation forward without needing perfect information or a detailed brief
• You are comfortable coordinating across time zones during incidents, which means occasionally working different hours
• You can explain a complex security incident to a non-technical stakeholder in two sentences without losing the technical nuance that matters for decision-making
• You move effectively between two modes of work: reactive incident investigation when something is on fire, and proactive security projects when things are quiet
• You push back when a detection is too noisy, a tool deployment plan is missing a critical step, or an incident response process is not going to work in practice
• You learn new security platforms quickly because you have architected and deployed tools before, and you know how to ask vendors and colleagues the right questions to get up to speed

The Team You'll Be Part Of

You will join the global CSIRT team, which is distributed across Chile, Bangalore, Ireland, and the U.S. East and West Coasts. The largest concentration of team members is in Bangalore. The team balances two primary areas of focus: responding to high-criticality cybersecurity incidents and investigations, and working on security projects and capability development between incidents, including implementing tools, creating detections, and standing up new security capabilities.

Rewards and Benefits

We offer a comprehensive range of health, wellness, and financial benefits to cater to your needs. Our total rewards include both monetary and non-monetary offerings. Your recruiter will provide more details about the salary range and benefits during the hiring process.