Security Engineer – Detection and Response

About the role

Notion is looking for a hands‑on Detection Engineer to protect the trust millions of users place in its collaborative AI workspace. You will design, build, and operate detection and response systems across a cloud‑native environment, working closely with engineering, corporate security, and infrastructure teams.

Key responsibilities

• Design and maintain high‑signal detections across cloud, identity, endpoints, and SaaS environments.
• Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and safe rollout.
• Develop tooling and automation to accelerate triage, enrichment, investigation, and detection authoring, including LLM‑based workflows where useful.
• Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements.
• Participate in investigations, incident response, post‑mortems, and a shared on‑call rotation.
• Define and track metrics such as coverage, mean‑time‑to‑detect (MTTD), and alert quality to guide investment decisions.

Required profile

• 6+ years of experience in detection engineering, security operations, incident response, or threat hunting.
• Proven track record building and operating production detections with strong signal quality and sustainable tuning.
• Fluent in one or more detection query languages (e.g., Sigma, KQL, SPL, YARA‑L, EQL, Panther).
• Offensive security mindset with experience leading purple‑team, blue‑team, or adversary‑emulation exercises.
• Strong cloud security experience in AWS, GCP, or Azure, including identity and access management.

Required skills

• Sigma
• KQL
• SPL
• YARA‑L
• EQL
• Panther
• AWS
• GCP
• Azure