Security Engineer, Detection and Response

About the role

Notion is looking for a hands‑on Detection Engineer to build and operate the systems and workflows that detect and respond to attacks across its cloud‑native environment. You will ship high‑signal detections, improve the detection platform, take part in incident response, and help shape how detection and response engineering scales at Notion.

Key responsibilities

• Design and maintain high‑signal detections across cloud, identity, endpoints, and SaaS environments.
• Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
• Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM‑based workflows where useful.
• Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements.
• Participate in investigations, incident response, and post‑mortems to drive long‑term security improvements.
• Define and track key metrics such as coverage, mean‑time‑to‑detect (MTTD), and alert quality to guide investment decisions.
• Participate in a shared on‑call rotation for incident response.

Required profile

• 6+ years of experience in detection engineering, security operations, incident response, or threat hunting.
• Proven experience building and operating production detections with strong signal quality and sustainable tuning processes.
• Fluency in one or more detection languages such as Sigma, KQL, SPL, YARA‑L, EQL, or Panther.
• Offensive security mindset with experience leading purple‑team, blue‑team, or adversary‑emulation exercises that improved detections and telemetry.
• Strong cloud security experience in AWS, GCP, or Azure, including identity‑related controls.

Required skills

• Sigma
• KQL
• SPL
• YARA‑L
• EQL
• Panther
• AWS
• GCP
• Azure