Vulnerability Management Analyst — Semiconductor IP

Descriptions & Requirements

Job Description and Requirements

Vulnerability Management Analyst - Semiconductor IP We Are: At Synopsys, we drive the innovations that shape the way we live and connect. Our technology is central to the Era of Pervasive Intelligence, from self-driving cars to learning machines. We lead in chip design, verification, and IP integration, empowering the creation of high-performance silicon chips and software content. Join us to transform the future through continuous technological innovation. You Are: You are someone who builds trust with product and engineering teams when the topic is risk. You listen first, explain complex findings in clear language, and own your conclusions. You help people understand what a vulnerability means for their work and what they should do next. You are practical when information is incomplete. You stay focused on timely action, challenge unclear choices in a respectful way, and keep looking for better ways to reduce risk. You care about teamwork, follow-through, and leaving guidance that others can use. This is a full-time role. What You’ll Be Doing: Analyze vulnerabilities affecting semiconductor IP products, firmware, and related interfaces, and determine residual risk with clear assumptions. Prioritize findings so product teams can act in a timely way: severity, exploitability, affected assets, and recommended mitigations. Work with design, verification, firmware, and product teams to explain vulnerabilities, walk through impact, and agree how the team will mitigate. Advise those teams on practical mitigations, compensating controls, and verification or test evidence that shows the risk is reduced. Work in semiconductor IP development and associated test flows, using the tools those teams use to design, verify, and test IP, so analysis matches how the product is actually built . Build and maintain your own analysis, intake, scoring, and reporting tools, including in Python, when existing tools are not enough. Scripts and tools should be readable and usable by other analysts. Track open risk through the cybersecurity lifecycle, from intake through analysis, treatment, verification, and internal release decisions, and keep status current. Facilitate working sessions so similar IP classes get consistent analysis, risk language, and mitigation guidance. Look for new and practical ways to detect, assess, and mitigate risk, including improved methods, automation, and lessons from prior findings. Use agentic workflows (AI agents, structured prompts, and human-in-the-loop review) to speed research and first drafts without handing off ownership of risk conclusions. Run the job in Jira, Confluence, Git, and GitLab : track vulnerability and risk work, keep documentation current, and version work products through review. The Impact You Will Have: Give product teams vulnerability analysis and risk determinations they can trust and act on without re-deriving the work. Reduce time-to-mitigation by explaining findings clearly and agreeing practical next steps with the teams that own the product. Leave mitigation and test guidance that design, verification, and firmware teams can execute. Keep residual risk visible and current so internal release and treatment decisions are based on evidence, not stale status. Improve consistency of vulnerability handling and risk language across similar IP classes. Raise the quality of risk reduction over time by bringing new methods, better mitigations, and fit-for-purpose tools into the workflow. What You’ll Need: Bachelor’s degree in electrical engineering, computer engineering, computer science, cybersecurity, or a related field, or equivalent practical experience. An advanced degree is welcome, not required. Typically 3 or more years in vulnerability management, product cybersecurity, embedded security, or a closely related engineering role. Stronger evidence on vulnerability analysis and risk determination can offset fewer years. Title