Security Engineer – Detection & Response

About the role

Notion is looking for a hands‑on Detection Engineer to design, build, and operate the systems that detect and respond to security incidents across its cloud‑native environment. You will work closely with engineering, corporate security, and infrastructure teams to protect the trust millions of users place in Notion.

Key responsibilities

• Design, implement and maintain high‑signal detections across cloud, identity, endpoint, and SaaS environments.
• Improve the detection platform, handling rule lifecycle, tuning, measurement, and safe rollout.
• Develop tooling and automation to accelerate triage, enrichment, investigation, and detection authoring, including LLM‑based workflows.
• Translate threat intelligence and adversary TTPs into durable detections and telemetry requirements.
• Participate in investigations, incident response, post‑mortems and on‑call rotation.
• Define and track metrics such as coverage, mean‑time‑to‑detect (MTTD) and alert quality.

Required profile

• 6+ years of experience in detection engineering, security operations, incident response or threat hunting.
• Proven track record of building production detections with strong signal quality and sustainable tuning.
• Offensive security mindset with experience leading purple‑team, blue‑team or adversary‑emulation exercises.
• Strong cloud security experience in AWS, GCP or Azure.

Required skills

• Sigma
• KQL
• SPL
• YARA‑L
• EQL
• Panther
• AWS
• GCP
• Azure