Cybersecurity Incident Response Engineer, Senior Staff

Synopsys•Morrisville, NC

35d•$161,000 - $242,000•Onsite

About The Position

Synopsys is hiring a Senior Staff Cybersecurity Incident Response Engineer to join its global CSIRT team. The role investigates high-severity cybersecurity incidents from detection through containment, determines scope and potential impact, and coordinates response across global and cross-functional teams. It also works with third-party cybersecurity and forensic providers and communicates technical findings as actionable guidance. Between incidents, the engineer strengthens security capabilities by developing and tuning detections, improving response procedures and playbooks, deploying and supporting security tools, and contributing to automation and other security initiatives. The role uses information from endpoint, network, cloud, email, and other sources to investigate threats and improve detection quality. It also assesses evolving threats and explores AI technologies, including LLM and agentic solutions, to improve security operations. The position is part of a globally distributed CSIRT team across Chile, Bangalore, Ireland, and the U.S. East and West Coasts. The role is intended to strengthen East Coast incident response coverage. Synopsys offers a base salary range of $161,000 to $242,000 across the U.S.; the role may also be eligible for an annual bonus, equity, and other discretionary bonuses. The position is not remote eligible and is based in Morrisville, North Carolina.

Requirements

At least 5 years of hands-on experience in incident response, security operations, or a related security function, including significant incident investigation experience.
Strong experience investigating active incidents, determining scope, coordinating containment, and working with multidisciplinary response teams.
Experience with formal incident response processes and coordination across technical and business teams.
Experience collaborating with third-party cybersecurity or forensic providers during investigations.
Hands-on experience with SIEM and endpoint detection and response technologies, including investigating and correlating activity across data sources.
Strong log and network analysis skills.
Strong technical knowledge of TCP/IP, HTTPS, FTP, SFTP, SSH, RDP, CIFS/SMB, and NFS.
Familiarity with AWS, Azure, and Microsoft 365 cloud and SaaS environments.
Strong understanding of Windows and general knowledge of Unix, Linux, and macOS.
Understanding of MITRE ATT&CK and the NIST Cybersecurity Framework in enterprise environments.
Practical experience with at least one development or scripting language, such as PowerShell, Python, or .NET, and with regular expressions.
Experience contributing to security initiatives outside active incident response, such as developing detections, deploying tools, automating processes, or establishing capabilities.
Strong written and verbal communication skills, including the ability to explain complex security issues to technical and nontechnical stakeholders.
Bachelor's degree in Information Security, Computer Science, or a related discipline, or an equivalent combination of education, training, and experience.

Nice To Haves

Experience with endpoint, cloud, and email security technologies such as CrowdStrike, Wiz, Proofpoint, or Abnormal.
Experience with security automation and orchestration technologies, including Microsoft Power Automate or comparable platforms.
Experience applying AI technologies, including LLM and agentic solutions, within security operations.
Relevant certifications such as GCIH, GCFE, GCFA, GCSA, GMON, CISSP, or similar.

Responsibilities

Investigate high-severity cybersecurity incidents from detection through containment, determining scope and coordinating response activities across global teams.
Work with third-party cybersecurity and forensic providers during significant investigations, managing handoffs and continuity across teams and time zones.
Correlate and analyze data across log sources, systems, and security technologies to investigate incidents and determine potential impact.
Collaborate with Detection Engineering and Threat Intelligence to improve alert quality, enrich detections, reduce noise, and apply investigation lessons.
Develop and tune security detections and contribute to the detection library, incident response procedures, documentation, and playbooks.
Deploy and support security tools and capabilities across endpoint, cloud, and email environments.
Coordinate response activities with teams outside cybersecurity and translate technical findings into clear, actionable guidance.
Contribute to security projects between incidents, including implementing tools, developing automation, and establishing new capabilities.
Stay current with evolving cyber threats and assess their potential effects on the environment.
Use AI technologies, including LLM and agentic solutions, to improve security operations and address alert scale.