Security Engineer – Detection & Response

About the role

Notion is looking for a hands‑on Detection Engineer to protect the trust millions of users place in its AI‑powered workspace. You will design, build, and operate high‑signal detections across a cloud‑native environment, working closely with engineering, corporate security, and infrastructure teams.

Key responsibilities

• Design, implement and maintain detections across cloud, identity, endpoint, and SaaS layers.
• Improve the detection platform, handling rule lifecycle, tuning, measurement and safe rollout.
• Develop tooling and automation for triage, enrichment, investigation and detection authoring, including LLM‑based workflows.
• Translate threat intelligence and adversary TTPs into durable detections and telemetry requirements.
• Participate in investigations, incident response, post‑mortems and on‑call rotation.
• Define and track metrics such as coverage, MTTD and alert quality to guide investments.

Required profile

• 6+ years of experience in detection engineering, security operations, incident response or threat hunting.
• Proven track record building production detections with strong signal quality and sustainable tuning.
• Offensive security mindset with experience leading purple‑team, blue‑team or adversary‑emulation exercises.
• Strong cloud security background in AWS, GCP or Azure.

Required skills

• Proficiency in detection query languages such as Sigma, KQL, SPL, YARA‑L, EQL or Panther.
• Hands‑on experience with AWS, GCP or Azure security services.
• Ability to translate threat intelligence into detection rules and telemetry.
• Experience building automation for detection authoring and incident triage.