Staff Security Strategist GRC

Synopsys•Morrisville, NC

10d•$161,000 - $242,000•Onsite

About The Position

Synopsys is seeking a Staff Security Strategist GRC to strengthen cybersecurity governance, risk, and compliance. The role develops and governs policies, standards, procedures, and control frameworks; guides stakeholders in implementing practical, risk-aligned controls; and monitors changes in regulatory, privacy, legal, and cybersecurity requirements. It leads compliance attestations and certifications, manages readiness and audit activities, and oversees documentation, evidence, findings, and remediation. The position partners with technical and business teams, assessors, Legal, Procurement, Privacy, and suppliers to assess controls, resolve gaps, review third-party security terms, and communicate risk through metrics and stakeholder updates. It also coordinates cybersecurity work related to business impact analyses and business continuity planning, exercises, and testing. The role is part of Synopsys’ Cybersecurity governance and compliance team and supports protection of the company’s assets, sensitive information, intellectual property, and reputation. The role is based in Morrisville, North Carolina, and is not remote eligible. The stated U.S. base salary range is $161,000–$242,000. The position may also be eligible for an annual bonus, equity, and other discretionary bonuses. Synopsys describes its benefits as comprehensive health, wellness, and financial benefits; further details are provided during the hiring process.

Requirements

Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or a related field, or an equivalent combination of education and relevant experience.
5–7 years of hands-on experience in cybersecurity governance, risk management, compliance, or a related discipline.
Experience applying ISO 27001, SOC 2, NIST 800-53, NIST CSF, NIST SP 800-171, CMMC, Cyber Essentials, and TISAX to governance, control implementation, assessments, or certification readiness.
Experience leading cross-functional GRC programs or initiatives involving audits, assessments, cybersecurity policy development, or business continuity planning and testing.
Strong program and project management skills, including establishing milestones, managing dependencies, coordinating stakeholders, and driving multiple initiatives to completion.
Strong analytical and problem-solving skills, including interpreting compliance, policy, and contractual requirements, evaluating evidence, identifying control gaps, and providing risk analysis.
Ability to translate compliance and contractual requirements into clear control expectations, risk-based recommendations, and actionable guidance.
Ability to collaborate across technical and non-technical teams and coordinate resolution of complex compliance and risk issues.
Excellent written, verbal, and presentation skills, including communicating complex cybersecurity, compliance, and risk topics to leadership, technical teams, business stakeholders, assessors, and external parties.

Nice To Haves

CISSP, CISM, or another relevant industry-recognized cybersecurity or risk management certification.

Responsibilities

Develop, maintain, review, and govern cybersecurity policies, standards, procedures, and control frameworks aligned with business objectives, regulatory obligations, industry standards, and changing risk requirements.
Advise control owners, system owners, and business stakeholders on translating policies and governance frameworks into practical, risk-aligned controls.
Monitor changes in cybersecurity, compliance, privacy, regulatory, and legal requirements; assess impacts and coordinate required updates.
Lead cybersecurity compliance attestations and certification programs, including readiness planning, assessor coordination, remediation oversight, and lifecycle management of SSPs, System Descriptions, ISMS plans, and related documentation.
Coordinate internal and external audits, mock audits, readiness reviews, gap assessments, and compliance assessments, including evidence preparation, stakeholder coordination, findings management, and corrective-action tracking.
Validate security-control implementation and operating effectiveness, identify evidence or control gaps, and partner with owners to address deficiencies.
Monitor control effectiveness between formal assessments using evidence validation, metrics, remediation tracking, and reporting.
Coordinate resolution of compliance gaps, control deficiencies, observations, and audit findings, establishing ownership, target dates, dependencies, and escalation paths.
Work with Legal, Procurement, Privacy, business stakeholders, and suppliers to review third-party contracts, security exhibits, data-protection terms, and proposed exceptions, and define risk-based requirements and remediation or compensating controls.
Coordinate cybersecurity elements of business impact analyses and business continuity plans; support exercises and testing, document results and corrective actions, and maintain evidence.
Communicate governance, compliance, certification, business continuity, control, and third-party risk through dashboards, metrics, management updates, and stakeholder education.