Senior Staff Detection Engineer at Synopsys in Greece Off-Site

Job description

At Synopsys, we want talented people of every background to feel valued and supported to do their best work. Synopsys considers all applicants for employment without regard to race, color, religion, national origin, gender, sexual orientation, age, military veteran status, or disability. Job Description and Requirements We Are Synopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products. We deliver industry-leading silicon design, IP, simulation and analysis solutions, and design services. We partner closely with our customers across a wide range of industries to maximize their R&D capability and productivity, powering innovation today that ignites the ingenuity of tomorrow. You Are You have deep experience building detections that actually work in production, where alert volume matters as much as coverage and where a false positive rate that looks fine on paper can quickly overwhelm an investigation team. You understand that the difference between a detection that gets used and one that gets muted often comes down to how well telemetry, attacker behavior, and operational reality are balanced. You don't wait for perfect log sources. When the available telemetry doesn't support what a stakeholder wants, you define the constraint clearly, identify what is feasible, and build agreement on the path forward. You think in detection lifecycles rather than one off rules, building reusable components, tuning based on investigator feedback, and documenting what response teams need to effectively work an alert. Insider risk and DLP work doesn't intimidate you. You understand that detecting risky user behavior requires different techniques from detecting external threats, and you're ready to extend a building block approach across multiple log sources to help develop user risk ranking. At Synopsys, you'll own complex detection problems from intake through production and help shape how the team approaches detection engineering. What You'll Be Doing Determine the methods, techniques, and evaluation criteria for new detection assignments, balancing telemetry coverage, attacker behavior, alert volume, and operational cost Drive the insider risk and DLP detection project, extending the building block approach across multiple log sources as you help build user risk ranking Own committed detections through production readiness by confirming target behavior, selecting supporting telemetry, testing detection logic, documenting expected false positives, and providing response guidance for Incident Response and Insider Threat teams Tune existing detection content using investigator feedback, alert volume, and precision metrics to improve the quality and actionability of alerts Use MITRE ATT&CK and the current threat landscape to identify coverage gaps and prioritize detections that address meaningful risks Evaluate and apply AI assisted workflows where they can improve detection development, enrichment, or triage, validating results before operational use Coach detection engineers earlier in their careers on design decisions, testing discipline, tuning strategy, and production readiness The Impact You Will Have More actionable insider risk and DLP alerts, giving Incident Response and Insider Threat investigators clearer signals to review while reducing effort spent on low value results A repeatable detection lifecycle built on shared methods, consistent evaluation criteria, and reusable components rather than isolated rules Stronger design and tuning decisions across the team as developing detection engineers apply consistent production readiness standards Shorter development and investigation cycles through validated AI assisted workflows for detection development, enrichment, and triage A detection library designed around available telemetry, real operational conditions, and the needs of the teams responding to alerts Clearer alignment between detection engineering and program