Cybersecurity Analyst — Semiconductor IP
Synopsys · Bengaluru
We Are:
At Synopsys, we drive the innovations that shape the way we live and connect. Our technology is central to the Era of Pervasive Intelligence, from self-driving cars to learning machines. We lead in chip design, verification, and IP integration, empowering the creation of high-performance silicon chips and software content. Join us to transform the future through continuous technological innovation.
You Are:
You are someone who builds trust with product and engineering teams and helps them do security work as part of normal delivery. You listen first, write in clear language, and own your conclusions. You work well with people in different disciplines and locations without needing to be the loudest person in the room.
You are practical when information is incomplete. You explain complex topics in simple terms, stay calm when the design changes, and challenge unclear choices in a respectful way. You care about teamwork, follow-through, and leaving work that others can use.
This is a full-time role.
What You’ll Be Doing:
- Lead threat analysis for semiconductor IP and associated firmware: identify assets, access points, threat scenarios, and attack paths, and recommend controls in the IP versus requirements for the integrator.
- Run security analysis as part of the cybersecurity lifecycle, from planning through design, implementation, verification, and release.
- Advise product teams on cybersecurity requirements, architecture, and verification so security work is built into the existing development flow.
- Author customer-facing security integration guidance that describes the threat landscape, implemented controls, and how customers should integrate the IP.
- Review RTL, architecture, and verification intent against secure-design principles; judge whether a claimed control is implemented and testable; capture integrator recommendations where needed.
- Support in-field cybersecurity activities for the products you cover, including vulnerability assessment, incident analysis, and security advisories, working with product-team architects and corporate vulnerability response as required.
- Facilitate working sessions with cybersecurity architects and design and verification leads; keep analysis consistent across similar IP classes.
- Deliver analysis incrementally with product teams working in agile sprints: plan security work against the product backlog, adjust scope when the design changes, and keep evidence current at each milestone.
- Use Python to automate analysis, transform inventories and threat-model data, and produce repeatable reports other analysts can run and review.
- Use agentic workflows (AI agents, structured prompts, and human-in-the-loop review) to speed research, first drafts, consistency checks, and routine tasks without handing off ownership of findings.
- Run the job in Jira, Confluence, Git, and GitLab: track analysis and incident work, keep project documentation current, and version work products through merge requests and review.
The Impact You Will Have:
- Give product teams threat analysis they can trust and act on without re-deriving the work.
- Leave cybersecurity requirements and verification objectives that design and verification teams can execute.
- Produce integration guidance that customers can follow without a security specialist in the room.
- Strengthen the cybersecurity lifecycle for IP products so security work stays current as the design changes.
- Improve consistency of analysis across similar IP classes through shared working sessions and clear written conclusions.
- Help the organization respond to in-field issues with clear assessment and practical advisories.
- Raise analysis throughput with Python and agentic workflows without lowering the quality of technical conclusions.
What You’ll Need:
- Bachelor’s degree in electrical engineering, computer engineering, computer science, or a related field, or equivalent practical experience. An advanced degree is welcome, not required.
- Typically, 4 or more years in product cybersecurity, embedded security, digital design, digital verification, or a closely related engineering role. Stronger evidence on the required capabilities can offset fewer years. Title (Analyst or Senior Analyst) will match demonstrated depth.
- Practical experience performing threat modeling or threat analysis and risk assessment on real products, not only training exercises.
- Ability to identify assets, attackers, attack surfaces, and attack paths, and to map each path to a mitigation (in-product control or integration requirement).
- Comfort working without a single known end-system: analysis must cover representative integration scenarios and state assumptions clearly.
- Experience applying a cybersecurity lifecycle across planning, requirements, design, implementation, verification, and release.
- Ability to turn threat-analysis results into requirements, design guidance, verification objectives, and release evidence.
- Hands-on understanding of embedded systems: SoC or MCU integration, firmware, hardware/software interfaces, memory-mapped registers, boot and debug, and on-chip interconnects.
- Ability to reason about hardware-rooted threats and firmware threats, and to read architecture, databooks, and interface specifications with the design team.
- Hands-on proficiency as a digital designer or a digital verification engineer. Either path is sufficient.
- Ability to read and discuss RTL (Verilog, SystemVerilog, or VHDL), architecture, interfaces, and register maps with designers and verification leads.
- Ability to judge whether a claimed cybersecurity control is implemented in the design and whether it is verifiable.
- Experience delivering analysis or engineering work inside agile product teams, including re-scoping when product content changes.
- Ability to write and maintain Python for analysis and automation. This is not a software-engineering role. Scripts should be readable and usable by other analysts.
- Practical experience using AI agents and agentic workflows to speed research, drafting, and repetitive analysis, while keeping the human as owner of technical conclusions.
- Hands-on use of Jira, Confluence, Git, and GitLab (or an equivalent Git forge) for tickets, documentation, and review.
- Clear written and spoken English; able to lead technical sessions with geographically distributed teams.
- Working knowledge of ISO/SAE 21434 or a comparable product-cybersecurity standard is helpful, as is analog or mixed-signal background, semiconductor IP product experience, vulnerability handling, or applied embedded cryptography.
Who You Are:
- You build trust with design teams and keep working relationships strong when the discussion is difficult.
- You own the technical conclusion. You do not hand off judgment to a tool, a template, or the loudest voice in the room.
- You write clearly so engineers and customers can use your work without you in the room.
- You work well with incomplete information and out-of-context IP, and you state assumptions instead of hiding them.
- You challenge unclear practices in a respectful way and recommend improvements teams can actually adopt.
- You are collaborative and non-disruptive with product teams, including when you need them to change course.
- You are structured and detail-oriented, and you keep evidence current as the design changes.
- You are comfortable with agile change and re-scope analysis without waiting for a late gate.
The Team You’ll Be A Part Of:
You will join the cybersecurity team that supports Synopsys semiconductor IP products. As an analyst, you are assigned to IP product teams and work in their delivery cadence. You collaborate with digital, analog, mixed-signal, and firmware engineers, and with cybersecurity architects, to complete analysis, guidance, and evidence through the cybersecurity lifecycle. The team works across regions. Your written work products are used by product teams and by customers who integrate the IP.
Rewards and Benefits:
We offer a comprehensive range of health, wellness, and financial benefits to cater to your needs. Our total rewards include both monetary and non-monetary offerings. Your recruiter will provide more details about the salary range and benefits during the hiring process.