Sr. Security Incident Management and Response Automation Engineer
50728BR
CANADA - Alberta - Calgary, USA - Florida - Oviedo, USA - Georgia - Atlanta, USA - Illinois - Chicago, USA - Illinois - Schaumburg, USA - Indiana - Bloomington, USA - Indiana - Indianapolis, USA - Massachusetts - Boston, USA - Massachusetts - Boxborough, USA - Massachusetts - Burlington, USA - Michigan - Detroit, USA - Michigan - Novi, USA - Minnesota - Bloomington, USA - Minnesota - Minneapolis, USA - Minnesota - Roseville, USA - Morrisville - North Carolina, USA - North Carolina - Durham, USA - Ohio - Cincinnati, USA - Ohio - Columbus, USA - Tennessee - Nashville, USA - Texas - Austin, USA - Texas - Dallas, USA - Texas - Houston, USA - Texas - Plano, USA - Williston - Vermont
Job Description and Requirements
Sr. Security Incident Management and Response Automation Engineer
At SIG, Synopsys' Software Integrity Group, we are enthusiastic learners and seasoned inventors. We are makers and visionaries who make technology safer. We are innovators who develop the best solutions to keep your software safe. Whether you're selling it directly to your customers or relying on it to run your operations, SIG helps you protect your bottom line by building trust in your software-at the speed your business demands. We embrace diversity as a company, so we can create solutions that serve not just technology but the humans behind it.
The Cybersecurity team is seeking a passionate, experienced, and collaborative practitioner to be a key member of our security operations team.
The Sr. Security Incident Management and Response Automation Engineer improves security event detection capabilities and leads response automation efforts across diverse security tooling and enterprise operating environments. This individual contributor monitors threats, trends, and attack patterns, partnering with security operations center analysts and business stakeholders to create relevant, actionable security content representations while balancing the need for high-fidelity detections and false positive reduction.
Key Responsibilities
Leads content building, tuning, and content lifecycle management using a variety of SIEM, endpoint, network, and cloud security tools
Guides research, mentors junior staff, and keeps current on the latest emerging threats, attack patterns, and adversaries
Works closely with security analysts and SOC staff to refine detections and reduce false positives
Learns about business initiatives, products, and attack surface to drive relevant security detections
Partners with stakeholders to drive improvements in technology and policy governance
Leads threat intelligence-gathering activities and conduct hypothesis-driven threat-hunting activities
Qualifications
Strong written and verbal communication skills; ability to establish and maintain strong working relationships with other functional groups
Demonstrates experience building security content for a variety of detection technologies such as Network and Host Intrusion Detection Systems (IDS), Endpoint Detection and Response (EDR), and SIEM
Possesses knowledge of a variety of threats, malicious actor personas, attack patterns, exploits, and common vulnerabilities
Understands the MITRE ATT&CK Frameworks, Cyber Kill Chain, and Diamond Model concepts
Has prior experience as an incident responder, a security operations analyst, or security engineer
Demonstrates and understanding of current and emerging security threats
Prior experience conducting and leading threat-hunting activities
Proficient with Regular Expressions (RegEx), SQL queries, YARA rules, network packet analysis, and JSON
Understanding of common attack patterns and Indicators of Compromise (IoCs) across Windows, MacOS, and Linux-based operating systems
Hands-on experience conducting data ingestion, parsing, normalization, and building alerting rules using an enterprise-grade SIEM solution (e.g., Elastic, Splunk, QRadar, SumoLogic, etc.)
Malware analysis experience and reverse-engineering skills
Experience creating scripts using Python or similar languages
Experience in incident investigations and response, computer forensics preferred
Thorough understanding of foundational operating system and networking concepts, including standard protocols such as TCP, HTTPS, SSH, RDP, etc.
7+ years in an incident response role or working in or with a security operations center
5+ years of experience in evaluating, deploying, and managing endpoint, network, and cloud security... For full info follow application link.
Synopsys maintains a workplace where all personnel, customers, and vendors are treated with dignity, fairness, and respect. We maintain worldwide policies in our Work Rules Policy, which is applicable to all employees in furtherance of these principles. We pride ourselves on providing a healthy and productive work environment that is free from discrimination and harassment based on race, color, religion, gender, gender identity, sexual orientation, marital status, veteran status, age, national origin, citizenship, ancestry, physical or mental disability, pregnancy, medical condition, and any other characteristic protected by law. For applicants and employees with disabilities, we also make reasonable accommodations consistent with applicable laws and regulations. We are each expected to do our part to create a healthy and productive work environment for everyone. This includes bringing issues to management’s attention when you believe certain conditions are distracting from a good work environment. Our Work Rules Policy also allows you to raise concerns with other Synopsys managers. If employees are still unable to resolve their concerns, their disputes may be resolved through our Internal Issue Resolution Process Policy. In addition, all managers and employees in positions of authority have a special obligation to maintain and support a healthy and productive work environment.