Vulnerability Management Analyst - Semiconductor IP

Job Title

Vulnerability Management Analyst - Semiconductor IP

Role Summary

Work on the CySec Vulnerability Management team supporting Synopsys semiconductor IP products. Analyze reported vulnerabilities affecting IP, firmware, and interfaces; determine residual risk; and coordinate practical mitigations with product, design, verification, and firmware teams.

This is a full-time, hands-on role combining technical analysis, risk determination, documentation, and tooling to reduce time-to-mitigation and keep residual risk visible through the cybersecurity lifecycle.

Experience Level

Mid-level. Typically 3+ years in vulnerability management, product cybersecurity, embedded security, or a closely related engineering role; demonstrated depth in vulnerability analysis can offset fewer years.

Responsibilities

Primary responsibilities include technical vulnerability analysis, risk communication, and lifecycle tracking. Key tasks:

• Analyze vulnerabilities affecting semiconductor IP, related firmware, and interfaces; document assumptions and determine residual risk.
• Prioritize findings by severity, exploitability, affected assets, and recommended mitigations.
• Collaborate with design, verification, firmware, and product teams to explain impact and agree mitigation plans.
• Advise on practical mitigations, compensating controls, and verification/test evidence showing risk reduction.
• Use and, when necessary, build readable analysis and reporting tools (Python scripts) for intake, scoring, and reporting.
• Track vulnerabilities through intake, analysis, treatment, verification, and internal release decisions; keep status current in tooling (Jira, Confluence, Git/GitLab).
• Facilitate consistent analysis and mitigation guidance across similar IP classes and improve detection and assessment methods over time.
• Use agentic workflows (AI agents with human-in-the-loop review) to accelerate research and drafting while retaining ownership of conclusions.

Requirements

Required practical skills and experience; items under "Nice-to-have" are helpful but not mandatory.

• Typically 3+ years of hands-on vulnerability analysis on real products (not only scanning or classroom exercises).
• Proven ability to determine and explain risk: severity, exploitability, affected assets, likelihood, impact, and residual risk after mitigations.
• Working familiarity with semiconductor IP development and associated test flows, and the ability to reason about how products are built.
• Ability to write and maintain readable analysis tools and scripts (Python); this is not a software engineering role but requires scripting for analysis and reporting.
• Experience operating with incomplete information and stating assumptions clearly.
• Experience applying a cybersecurity lifecycle across planning, design, implementation, verification, and internal release, and tracking risk to closure.
• Hands-on understanding of embedded systems sufficient to reason about hardware-rooted and firmware vulnerabilities (SoC/MCU integration, firmware, interfaces, registers, boot/debug, interconnects).
• Practical experience using AI agents and agentic workflows while keeping human ownership of technical conclusions.
• Hands-on use of Jira, Confluence, Git, and GitLab (or equivalent) for tickets, documentation, and review.
• Clear written and spoken English; able to lead technical sessions with distributed teams.

Nice-to-have:

• Familiarity with CVSS or other vulnerability scoring practices, ISO/SAE 21434 or comparable product-cybersecurity standards.
• Digital design or verification background (including RTL) and semiconductor IP product experience.
• Applied experience in embedded cryptography or related secure-design practices.

Education Requirements

Bachelor's degree in electrical engineering, computer engineering, computer science, cybersecurity, or a related field, or equivalent practical experience. Advanced degree is welcome but not required. Equivalent practical experience is explicitly accepted.

About the Company

Company: Synopsys

Headquarters: Mountain View, California, USA

Synopsys is a leading company in electronic design automation (EDA) and semiconductor IP solutions. It provides tools and services for designing and verifying complex semiconductor devices and systems. The company plays a pivotal role in the semiconductor industry, helping engineers innovate and deliver higher-quality products faster. Synopsys is committed to advancing technology standards and offers a range of software and hardware solutions to its clients globally.