Security Engineer – Detection & Response

About the role

Notion is seeking a hands‑on Security Engineer focused on detection and response to protect its cloud‑native platform. You will design, build and operate high‑signal detection rules, improve the underlying detection platform and take part in incident response across cloud, identity, endpoint and SaaS environments.

Key responsibilities

• Design, implement and maintain high‑signal detections for AWS, GCP or Azure workloads.
• Develop and enhance the detection platform, including rule lifecycle, tuning, measurement and safe rollout.
• Create tooling and automation to accelerate triage, enrichment, investigation and detection authoring, leveraging LLM‑based workflows where appropriate.
• Translate threat intelligence and adversary TTPs into durable detections and telemetry requirements.
• Participate in investigations, incident response, post‑mortems and on‑call rotations.
• Define and track metrics such as coverage, mean‑time‑to‑detect (MTTD) and alert quality to guide investments.

Required profile

• 6+ years of experience in detection engineering, security operations, incident response or threat hunting.
• Proven track record of building production‑grade detections with strong signal quality and sustainable tuning.
• Offensive‑security mindset with experience leading purple‑team, blue‑team or adversary‑emulation exercises.
• Strong cloud security background in AWS, GCP or Azure.

Required skills

• Detection query languages: Sigma, KQL, SPL, YARA‑L, EQL or Panther.
• Cloud platforms: AWS, GCP, Azure.
• Threat intelligence translation and adversary TTP mapping.
• Incident response and on‑call rotation experience.