Detection Engineer , Sr Staff Engineer, 19265

Job Description and Requirements

We Are

Synopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products. We deliver industry-leading silicon design, IP, simulation and analysis solutions, and design services. We partner closely with our customers across a wide range of industries to maximize their R&D capability and productivity, powering innovation today that ignites the ingenuity of tomorrow.

You Are

You have deep experience building detections that actually work in production, where alert volume matters as much as coverage and where a false positive rate that looks fine on paper can quickly overwhelm an investigation team. You understand that the difference between a detection that gets used and one that gets muted often comes down to how well telemetry, attacker behavior, and operational reality are balanced.

You don't wait for perfect log sources. When the available telemetry doesn't support what a stakeholder wants, you define the constraint clearly, identify what is feasible, and build agreement on the path forward. You think in detection lifecycles rather than one off rules, building reusable components, tuning based on investigator feedback, and documenting what response teams need to effectively work an alert.

Insider risk and DLP work doesn't intimidate you. You understand that detecting risky user behavior requires different techniques from detecting external threats, and you're ready to extend a building block approach across multiple log sources to help develop user risk ranking. At Synopsys, you'll own complex detection problems from intake through production and help shape how the team approaches detection engineering.

What You'll Be Doing

• Determine the methods, techniques, and evaluation criteria for new detection assignments, balancing telemetry coverage, attacker behavior, alert volume, and operational cost

• Drive the insider risk and DLP detection project, extending the building block approach across multiple log sources as you help build user risk ranking

• Own committed detections through production readiness by confirming target behavior, selecting supporting telemetry, testing detection logic, documenting expected false positives, and providing response guidance for Incident Response and Insider Threat teams

• Tune existing detection content using investigator feedback, alert volume, and precision metrics to improve the quality and actionability of alerts

• Use MITRE ATT&CK and the current threat landscape to identify coverage gaps and prioritize detections that address meaningful risks

• Evaluate and apply AI assisted workflows where they can improve detection development, enrichment, or triage, validating results before operational use

• Coach detection engineers earlier in their careers on design decisions, testing discipline, tuning strategy, and production readiness

The Impact You Will Have

• More actionable insider risk and DLP alerts, giving Incident Response and Insider Threat investigators clearer signals to review while reducing effort spent on low value results

• A repeatable detection lifecycle built on shared methods, consistent evaluation criteria, and reusable components rather than isolated rules

• Stronger design and tuning decisions across the team as developing detection engineers apply consistent production readiness standards

• Shorter development and investigation cycles through validated AI assisted workflows for detection development, enrichment, and triage

• A detection library designed around available telemetry, real operational conditions, and the needs of the teams responding to alerts

• Clearer alignment between detection engineering and program stakeholders when available telemetry can't support a request, including agreement on what is feasible and what additional data would be required

What You'll Need

• Bachelor's degree and a minimum of 6 years of related experience, or an advanced degree and a minimum of 5 years of related experience in detection engineering, security operations, red teaming, insider threat, or incident response, with substantial experience building detection content

• Experience building detection content in an enterprise SIEM. Elastic experience is strongly preferred

• Experience working with security telemetry from EDR, firewalls, IDS/IPS, cloud platforms, DLP, or similar enterprise sources

• Experience applying incident response, investigation, or security operations knowledge to detection design. Experience supporting insider threat or DLP programs is highly relevant, but deep detection engineering expertise is the primary requirement

• Working knowledge of MITRE ATT&CK and its application to detection design

• Proficiency in Python or another relevant programming language, with familiarity with Detection as Code, CI/CD, and security automation

Who You Are

• Comfortable making sound technical decisions on complex or unfamiliar problems with limited supervision, selecting an appropriate approach and evaluation criteria without requiring a detailed specification

• Precise about what a log source can support and able to align partner teams on what is feasible when available telemetry cannot meet a request

• Focused on outcomes, building detections that hold up once real alerts start firing and provide investigators with actionable signals

• Comfortable leading a deep body of work, starting with insider risk and DLP telemetry before moving to the next committed priority

• Generous with technical judgment and feedback, helping other engineers improve how they design, test, and tune detections

• Pragmatic about AI, identifying workflows where it can add value while validating results before operational use

The Team You'll Be Part Of

You will report to the Senior Manager of Cyber Security Engineering, based in Austin, Texas. The team is distributed across multiple countries, including colleagues in Greece, and operates in a global environment. The detections you build will feed directly into Incident Response and Insider Threat teams, so you will work closely with investigators who depend on your content to surface actionable signals.

Rewards and Benefits

We offer a comprehensive range of health, wellness, and financial benefits to cater to your needs. Our total rewards include both monetary and non-monetary offerings. Your recruiter will provide more details about the salary range and benefits during the hiring process.

At Synopsys, we want talented people of every background to feel valued and supported to do their best work. Synopsys considers all applicants for employment without regard to race, color, religion, national origin, gender, sexual orientation, age, military veteran status, or disability.