Staff Security Strategist GRC

Synopsys•Morrisville, NC

10d•$129,000 - $193,000•Onsite

About The Position

Synopsys is seeking a cybersecurity professional to join its Cybersecurity governance and compliance team. The role strengthens cybersecurity governance and compliance while helping protect company assets, sensitive information, intellectual property, and reputation. It works with partners across IT, Engineering, Business Operations, Legal, Procurement, Privacy, and other functions. The position governs cybersecurity policies, standards, procedures, and control frameworks; supports compliance attestations and certification programs; and coordinates internal and external audits, assessments, evidence collection, findings, and remediation. It also advises control owners and business stakeholders on practical, risk-aligned controls, reviews supplier security and contractual requirements, and coordinates cybersecurity aspects of business impact analyses and continuity planning. The role monitors control effectiveness and communicates governance, compliance, continuity, control, and third-party risk through dashboards, metrics, management updates, and stakeholder education. The position is based in Morrisville, North Carolina, and is not remote eligible. The listed U.S. base salary range is $129,000–$193,000. The role may also be eligible for an annual bonus, equity, and other discretionary bonuses. Synopsys describes its total rewards package as including health, wellness, and financial benefits; further details are provided by the recruiter during the hiring process.

Requirements

Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or a related field, or an equivalent combination of education and relevant experience.
5–7 years of hands-on experience in cybersecurity governance, risk management, compliance, or a related discipline.
Experience applying frameworks including ISO 27001, SOC 2, NIST 800-53, NIST CSF, NIST SP 800-171, CMMC, Cyber Essentials, and TISAX to governance, control implementation, assessments, or certification readiness.
Experience leading cross-functional GRC programs or initiatives involving audits, assessments, cybersecurity policy development, or business continuity planning and testing.
Strong program and project management skills, including establishing milestones, managing dependencies, coordinating stakeholders, and driving multiple initiatives to completion.
Strong analytical and problem-solving skills, including interpreting compliance, policy, and contractual requirements, evaluating evidence, identifying control gaps, and providing risk analysis.
Ability to translate compliance and contractual requirements into clear control expectations, risk-based recommendations, and actionable guidance.
Ability to collaborate across technical and non-technical teams and coordinate resolution of complex compliance and risk issues.
Excellent written, verbal, and presentation skills, including communicating complex cybersecurity, compliance, and risk topics clearly to leadership, technical teams, business stakeholders, assessors, and external parties.

Nice To Haves

CISSP, CISM, or another relevant industry-recognized cybersecurity or risk management certification.

Responsibilities

Develop, maintain, review, and govern cybersecurity policies, standards, procedures, and control frameworks in alignment with business objectives, regulations, industry standards, and evolving risks.
Advise control owners, system owners, and business stakeholders on translating cybersecurity policies and governance frameworks into practical, risk-aligned controls.
Monitor cybersecurity, compliance, privacy, regulatory, and legal requirements; assess their impact and coordinate necessary updates.
Lead cybersecurity compliance attestations and certification programs, including readiness planning, assessor coordination, remediation oversight, and management of SSPs, System Descriptions, ISMS plans, and related documentation.
Coordinate internal and external audits, mock audits, readiness reviews, gap assessments, and compliance assessments, including evidence preparation, stakeholder coordination, findings management, and corrective-action tracking.
Validate security-control implementation and operating effectiveness, identify gaps, and work with system and control owners to address deficiencies.
Monitor control effectiveness between formal assessments through evidence validation, metrics, remediation tracking, and reporting.
Coordinate resolution of compliance gaps, control deficiencies, observations, and audit findings, establishing owners, target dates, dependencies, and escalation paths.
Work with Legal, Procurement, Privacy, business stakeholders, and suppliers to review third-party contracts, security exhibits, data protection terms, and exceptions, and define risk-based security requirements and remediation or compensating controls.
Coordinate cybersecurity elements of Business Impact Analyses and business continuity plans; support exercises and testing, document results and corrective actions, and maintain supporting evidence.
Communicate cybersecurity governance, compliance, certification, business continuity, control, and third-party risk through dashboards, metrics, management updates, and stakeholder education.