Security Engineer – Detection & Response

About the role

Notion is looking for a hands‑on Detection Engineer to design, build, and operate the systems that detect and respond to threats across its cloud‑native environment. You will work closely with engineering, corporate security, and infrastructure teams to protect the trust millions of users place in Notion every day.

Key responsibilities

• Design, implement, and maintain high‑signal detections across cloud, identity, endpoint, and SaaS environments.
• Improve the detection platform, handling rule lifecycle, tuning, measurement, and safe rollout.
• Develop tooling and automation to accelerate triage, enrichment, investigation, and detection authoring, including LLM‑based workflows where appropriate.
• Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response enhancements.
• Participate in investigations, incident response, post‑mortems, and on‑call rotations.
• Define and track metrics such as coverage, mean‑time‑to‑detect (MTTD), and alert quality to guide investment decisions.

Required profile

• 6+ years of experience in detection engineering, security operations, incident response, or threat hunting.
• Proven track record building production detections with strong signal quality and sustainable tuning.
• Offensive security mindset with experience leading purple‑team, blue‑team, or adversary‑emulation exercises.
• Strong cloud security experience in AWS, GCP, or Azure.

Required skills

• Sigma
• KQL
• SPL
• YARA‑L
• EQL
• Panther
• AWS
• GCP
• Azure