Security Engineer, Detection and Response

About the Company

Notion is a collaborative AI workspace designed to unite teams and agents to think and work together seamlessly. It integrates knowledge, projects, meetings, and AI tools in a single platform that is trusted and used by millions of individuals and organizations globally. Notion's team, known as Notinos, focuses on craftsmanship to create lasting products that enhance human collaboration in the era of AI.

Role Overview

We are seeking an experienced Detection Engineer to build and operate advanced systems for identifying and responding to security threats within Notion's cloud-native infrastructure. In this role, you will develop precise detection methods, enhance detection platforms, engage in incident response, and influence how detection and response efforts scale within the company. Collaboration with Engineering, Corporate Security, and Infrastructure teams is key, providing you with broad autonomy to identify gaps and prioritize solutions.

Key Responsibilities

• Design and sustain effective detection mechanisms across cloud environments, identity systems, endpoints, and SaaS platforms.
• Enhance the detection platform by managing rule lifecycles, tuning processes, measurement, and ensuring safe deployment.
• Create automation tools to speed up triage, data enrichment, investigations, and authoring of detections, including utilizing LLM-based workflows when applicable.
• Convert threat intelligence and adversary tactics, techniques, and procedures (TTPs) into reliable detections, telemetry needs, and response strategies.
• Participate actively in investigations, incident responses, and postmortems to foster continual security improvement.
• Define and monitor crucial metrics like coverage, mean time to detect (MTTD), and alert quality to guide resource allocation.
• Engage in on-call rotations to support incident response efforts.

Required Qualifications

• Minimum of 6 years in detection engineering, security operations, incident response, or threat hunting.
• Experience creating and managing high-quality detection rules with sustainable tuning practices.
• Proficiency in detection query languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.
• Strong offensive security perspective with experience leading purple team, blue team, or adversary emulation activities to improve detection and telemetry.
• Comprehensive cloud security expertise in AWS, GCP, or Azure, particularly in detecting identity-based attacks.
• Hands-on experience with SIEM, EDR, and SOAR tools in large enterprise environments.
• Excellent communication skills for producing design documentation, runbooks, and incident reports, and ability to independently manage projects.

Preferred Skills

• Familiarity with applying large language models or agent-driven tools within security processes.
• Experience securing AI-powered systems or endpoint management tools.
• Knowledge of Kubernetes or container security detection.
• Background in threat intelligence, malware analysis, or digital forensics.
• Contributions to the detection engineering community through research, tools, or speaking engagements.
• Experience working in fast-paced startups or AI-focused companies.

Compensation and Benefits

Notion offers highly competitive cash salaries, equity, and comprehensive benefits. The estimated base salary for this role ranges between €127,000 and €142,000 annually, with final compensation tailored based on location, role scope, experience, and expertise.

Additional Information

Notion is committed to fostering an inclusive work environment and actively encourages applications from candidates of diverse backgrounds. The company provides reasonable accommodations throughout the hiring process. Candidates need not meet every single qualification bullet to apply and are encouraged to submit their applications.

Applicants agree that Notion and its affiliates will process their personal information in compliance with applicable privacy policies.

On AI Use

The role does not require deep AI expertise but values intellectual curiosity and the willingness to utilize AI as a collaborative tool to enhance work quality and efficiency.