← All roles

Security Engineer, Detection and Response

Notion· Security
Apply on company site
Hybrid (San Francisco, California), Hybrid (New York, New York)$185k - $280kFull-timePosted 8mo ago

About the role

Hands-on Detection Engineer to build and operate detection and response systems across Notion’s cloud-native environment, contributing to detections, platform improvements, incident response, and scalability of detection and response engineering.

Responsibilities

  • Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments, with review and mentorship from senior teammates as you ramp up.
  • Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
  • Build tooling and automation that speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
  • Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements.
  • Take part in investigations, incident response, and postmortems, and help turn what we learn into lasting fixes.
  • Help define and track metrics such as coverage, MTTD, and alert quality.
  • Join a shared on-call rotation for incident response.

Qualifications

  • 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role.
  • Have written or tuned detections that run in production, and care about signal quality and cutting noise.
  • Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly.
  • An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect.
  • Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs.
  • Have used SIEM, EDR, or SOAR tools in any size of environment.
  • Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end.

Skills

Required:Detection engineeringDetection/query languagesThreat modeling using MITRE ATT&CKCloud platformsSIEM/EDR/SOARRunbooks and design docs
Last updated Sep 30, 2026. Interested? Apply on the company site.
Notion logo

About Notion

The AI workspace that works for you.

Build custom agents, search across all your apps, and automate busywork. The AI workspace where teams get more done, faster.

AIsearchautomationteam collaborationknowledge baseproductivity
Company profileWebsite

More open roles at Notion