Security Engineer, Detection and Response

About Notion

Notion is an innovative collaborative AI workspace designed for teams and agents to seamlessly integrate knowledge, projects, meetings, and AI tools to boost productivity and clarity. It serves millions of users ranging from individuals to large enterprises, fostering a unified work environment. Notion employees, known as Notinos, place significant emphasis on craftsmanship and creating sustainable solutions that prioritize the human aspect of work. Their mission transcends merely launching new features to establish standards for human collaboration in the AI era, from building comprehensive business systems to automating routine tasks.

Role Overview

As a Security Engineer in Detection and Response based in Dublin, you will be entrusted with safeguarding Notion’s cloud-native infrastructure by creating and managing systems for identifying and mitigating attacks. Your responsibilities include developing precise detection mechanisms, enhancing the underlying detection platform, contributing to incident response efforts, and establishing scalable detection and response processes.

Key Responsibilities

• Architect and sustain effective detection rules spanning cloud, identity, endpoints, and SaaS platforms.
• Enhance the detection platform focusing on rule management, performance measurement, tuning, and safe deployment.
• Create automation and toolsets that expedite incident triage, data enrichment, investigation, and authoring of detection rules, leveraging large language models when advantageous.
• Convert threat intelligence and adversarial tactics into robust detections, telemetry frameworks, and enhanced response protocols.
• Engage in security investigations, incident management, and post-incident analyses to foster continuous improvements.
• Establish and monitor essential metrics such as coverage, mean time to detect (MTTD), and alert accuracy to prioritize security projects.
• Contribute actively to a shared on-call schedule to manage incident responses.

Required Qualifications

• Minimum of six years of experience in detection engineering, security operations, incident response, or threat hunting.
• Demonstrated ability to design and maintain production-level detection systems with high precision and sustainable calibration practices.
• Proficiency with detection languages like Sigma, Kusto Query Language (KQL), SPL, YARA-L, EQL, or Panther.
• Strong offensive security mindset, with experience leading purple team, blue team, or adversarial emulation exercises that enhance security detections and telemetry.
• Expertise in cloud security for platforms such as AWS, Google Cloud Platform, or Azure, particularly in detecting identity-related attacks.
• Hands-on experience with SIEM, EDR, and SOAR solutions in complex, large-scale environments.
• Strong written and verbal communication skills for documentation such as design documents, operational playbooks, and incident reports, with the capability to lead projects independently.

Preferred Qualifications

• Experience integrating large language models or agent-based tools into security operations workflows.
• Knowledge of securing AI-powered systems and endpoint protection methods.
• Familiarity with Kubernetes or container security detection.
• Background in threat intelligence, malware analysis, or digital forensics.
• Contributions to detection engineering communities via research, tooling development, or presentations.
• Exposure to working within high-growth startups or AI-focused organizations.

Compensation and Benefits

Notion offers a highly competitive salary package complemented by equity and benefits. For this position, the expected base salary ranges from €127,000 to €142,000 annually, with actual compensation determined based on factors including location, role complexity, and candidate expertise.

Diversity, Equity & Inclusion

Notion is an equal opportunity employer committed to inclusive hiring practices. The company encourages candidates from diverse backgrounds to apply, including those who may not meet every listed qualification. Reasonable accommodations are provided throughout the application process for qualifying individuals. Notion ensures fair treatment regardless of race, ethnicity, religion, gender identity, sexual orientation, disability status, veteran status, or any legally protected characteristic.

Commitment to AI Integration

While not all positions require deep AI expertise, all employees are encouraged to embrace AI as a collaborative tool to enhance creativity, productivity, and problem-solving within their roles.