Hardware Security Analyst - Semiconductor IP

• Lead threat analysis for semiconductor IP and associated firmware: identify assets, access points, threat scenarios, and attack paths, and recommend controls in the IP versus requirements for the integrator.

• Lead threat analysis for semiconductor IP and associated firmware: identify assets, access points, threat scenarios, and attack paths, and recommend controls in the IP versus requirements for the integrator.
• Run security analysis as part of the cybersecurity lifecycle, from planning through design, implementation, verification, and release.
• Advise product teams on cybersecurity requirements, architecture, and verification so security work is built into the existing development flow.
• Author customer-facing security integration guidance that describes the threat landscape, implemented controls, and how customers should integrate the IP.
• Review RTL, architecture, and verification intent against secure-design principles; judge whether a claimed control is implemented and testable; capture integrator recommendations where needed.
• Support in-field cybersecurity activities for the products you cover, including vulnerability assessment, incident analysis, and security advisories, working with product-team architects and corporate vulnerability response as required.
• Facilitate working sessions with cybersecurity architects and design and verification leads; keep analysis consistent across similar IP classes.
• Deliver analysis incrementally with product teams working in agile sprints: plan security work against the product backlog, adjust scope when the design changes, and keep evidence current at each milestone.
• Use Python to automate analysis, transform inventories and threat-model data, and produce repeatable reports other analysts can run and review.
• Use agentic workflows (AI agents, structured prompts, and human-in-the-loop review) to speed research, first drafts, consistency checks, and routine tasks without handing off ownership of findings.
• Run the job in Jira, Confluence, Git, and GitLab: track analysis and incident work, keep project documentation current, and version work products through merge requests and review.

• Give product teams threat analysis they can trust and act on without re-deriving the work.

• Give product teams threat analysis they can trust and act on without re-deriving the work.
• Leave cybersecurity requirements and verification objectives that design and verification teams can execute.
• Produce integration guidance that customers can follow without a security specialist in the room.
• Strengthen the cybersecurity lifecycle for IP products so security work stays current as the design changes.
• Improve consistency of analysis across similar IP classes through shared working sessions and clear written conclusions.
• Help the organization respond to in-field issues with clear assessment and practical advisories.
• Raise analysis throughput with Python and agentic workflows without lowering the quality of technical conclusions.

• Bachelor’s degree in electrical engineering, computer engineering, computer science, or a related field, or equivalent practical experience. An advanced degree is welcome, not required.

• Bachelor’s degree in electrical engineering, computer engineering, computer science, or a related field, or equivalent practical experience. An advanced degree is welcome, not required.
• Typically, 4 or more years in product cybersecurity, embedded security, digital design, digital verification, or a closely related engineering role . Stronger evidence on the required capabilities can offset fewer years. Title (Analyst or Senior Analyst) will match demonstrated depth.
• Practical experience performing threat modeling or threat analysis and risk assessment on real products, not only training exercises.
• Ability to identify assets, attackers, attack surfaces, and attack paths, and to map each path to a mitigation (in-product control or integration requirement).
• Comfort working without a single known end-system: analysis must cover representative integration scenarios and state assumptions clearly.
• Experience applying a cybersecurity lifecycle across planning, requirements, design, implementation, verification, and release.
• Ability to turn threat-analysis results into requirements, design guidance, verification objectives, and release evidence.
• Hands-on understanding of embedded systems: SoC or MCU integration, firmware, hardware/software interfaces, memory-mapped registers, boot and debug, and on-chip interconnects.
• Ability to reason about hardware-rooted threats and firmware threats, and to read architecture, databooks, and interface specifications with the design team.
• Hands-on proficiency as a digital designer or a digital verification engineer. Either path is sufficient.
• Ability to read and discuss RTL (Verilog, SystemVerilog, or VHDL), architecture, interfaces, and register maps with designers and verification leads.
• Ability to judge whether a claimed cybersecurity control is implemented in the design and whether it is verifiable.
• Experience delivering analysis or engineering work inside agile product teams, including re-scoping when product content changes.
• Ability to write and maintain Python for analysis and automation. This is not a software-engineering role. Scripts should be readable and usable by other analysts.
• Practical experience using AI agents and agentic workflows to speed research, drafting, and repetitive analysis, while keeping the human as owner of technical conclusions.
• Hands-on use of Jira, Confluence, Git, and GitLab (or an equivalent Git forge) for tickets, documentation, and review.
• Clear written and spoken English; able to lead technical sessions with geographically distributed teams.
• Working knowledge of ISO/SAE 21434 or a comparable product-cybersecurity standard is helpful, as is analog or mixed-signal background, semiconductor IP product experience, vulnerability handling, or applied embedded cryptography.

• You build trust with design teams and keep working relationships strong when the discussion is difficult. <li