Security Strategist GRC

Synopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products. We deliver industry-leading silicon design, IP, simulation and analysis solutions, and design services. We partner closely with our customers across a wide range of industries to maximize their R&D capability and productivity, powering innovation today that ignites the ingenuity of tomorrow.

You are a thoughtful, detail-oriented cybersecurity professional with strong experience in governance, risk, and compliance. You understand cybersecurity frameworks such as ISO 27001, SOC 2, NIST 800-53, and NIST SP 800-171, and know how to translate regulatory and security requirements into practical, sustainable controls.

You have experience developing and maintaining cybersecurity policies, standards, and procedures, supporting audits and compliance assessments, reviewing third-party security requirements, and contributing to business continuity planning and testing. You are comfortable building audit-ready documentation, coordinating evidence collection, identifying control gaps, and driving remediation activities across multiple teams.

You work effectively with technical teams, business functions, internal audit, assessors, and leadership. You communicate cybersecurity, compliance, and risk topics clearly, manage competing priorities effectively, and bring structure and accountability to complex GRC initiatives.

• Develop, maintain, review, and govern cybersecurity policies, standards, procedures, and control frameworks, ensuring alignment with business objectives, regulatory obligations, industry standards, and evolving risk requirements.
• Advise control owners, system owners, and business stakeholders on translating cybersecurity policies and governance frameworks into practical, risk-aligned controls.
• Monitor changes in cybersecurity, compliance, privacy, regulatory, and legal requirements, assess their impact on controls, certifications, and business processes, and coordinate required updates.
• Lead cybersecurity compliance attestations and certification programs, including readiness planning, assessor coordination, remediation oversight, and lifecycle management of SSPs, System Descriptions, ISMS plans, and related documentation.
• Coordinate internal and external audits, mock audits, readiness reviews, gap assessments, and compliance assessments, including evidence preparation, stakeholder coordination, findings management, and corrective action tracking.
• Validate the implementation and operating effectiveness of security controls, identify evidence or control gaps, and partner with system and control owners to address deficiencies.
• Monitor control effectiveness between formal assessments using evidence validation, control metrics, remediation tracking, and reporting.
• Partner with Cybersecurity, IT, business teams, assessors, system owners, and control owners to resolve compliance gaps, control deficiencies, observations, and audit findings, including establishing ownership, target dates, dependencies, and escalation paths.
• Partner with Legal, Procurement, Privacy, business stakeholders, and suppliers to review third-party contracts, security exhibits, data protection terms, and proposed exceptions, defining risk-based security requirements and appropriate remediation or compensating controls.
• Coordinate the cybersecurity elements of Business Impact Analyses and business continuity plans, support exercises and testing, document results and corrective actions, and maintain supporting evidence.
• Communicate cybersecurity governance, compliance, certification, business continuity, control, and third-party risk through clear dashboards, metrics, management updates, and stakeholder education.

• Improve audit readiness through continuous control verification, effective evidence management, and stronger assessment processes.
• Strengthen Synopsys' cybersecurity governance and compliance posture by advancing GRC policies, controls, documentation, and processes.
• Reduce third-party cybersecurity risk by strengthening security requirements and contracting practices for suppliers and partners.
• Increase organizational resilience through effective business continuity planning, testing, and corrective actions.
• Support regulatory compliance and responsible business growth by translating cybersecurity frameworks and requirements into practical guidance for technical and…