Security Engineer - Detection and Response

About Notion

Notion is a collaborative AI-driven workspace designed to unify knowledge, projects, meetings, and AI tools into a single platform, enhancing team productivity and reducing fragmented efforts. Millions worldwide rely on Notion, embracing a vision rooted in human-centric innovation and craftsmanship. Our teams strive to transform how humans collaborate in the AI era, helping businesses automate mundane tasks and focus on core work.

Role Overview

As a Detection Engineer, you will architect and manage systems to identify and respond to security threats within Notion's cloud-native environment. You'll develop precise detection mechanisms, enhance detection platforms, engage in incident response, and contribute to the evolution of detection and response engineering practices.

Key Responsibilities

• Construct and sustain precise detection mechanisms across cloud, identity, endpoint, and SaaS domains.
• Enhance detection platforms with features such as rule lifecycle management, fine-tuning, metric tracking, and safe deployment.
• Create automation tools to speed up incident triage, enrichment, investigations, and detection development, including integrations with large language model-based workflows.
• Convert threat intelligence and attacker tactics into durable detections, required telemetry, and improved response procedures.
• Take an active role in investigations, incident handling, and post-incident analyses to foster continual security enhancements.
• Define and monitor impactful metrics like detection coverage, mean-time-to-detect, and alert fidelity to guide strategic priorities.
• Share on-call duties to support incident response operations.

Required Qualifications

• Minimum of six years in detection engineering, security operations, incident response, or threat hunting roles.
• Proven experience developing and managing production-grade detections with effective tuning strategies.
• Proficiency in detection query languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.
• Experience leading offensive security exercises, including purple team and adversary simulation activities aimed at improving detections and telemetry.
• Strong expertise in cloud security using platforms like AWS, GCP, or Azure, with a focus on identity-related threat detection.
• Hands-on familiarity with SIEM, EDR, and SOAR solutions in complex environments.
• Excellent communication skills for writing design documents, runbooks, and incident reports; ability to oversee projects autonomously.

Desirable Attributes

• Experience applying AI and language models within security processes.
• Knowledge of securing AI-powered systems or endpoint security tools.
• Expertise in Kubernetes and container-related detection.
• Background in threat analysis, malware research, or digital forensic investigations.
• Contributions to detection engineering communities via research, tools, or talks.
• Experience working in dynamic, high-growth startups or AI-focused companies.

Compensation & Benefits

Notion offers highly competitive salary packages, equity participation, and benefits. The base salary for this position is approximately between €127,000 and €142,000 annually, with the final offer determined by location, role complexity, and candidate expertise.

Additional Information

Applicants acknowledge that their personal information will be processed according to Notion’s recruiting privacy standards upon submission.

Commitment to Diversity and Inclusion

Notion is dedicated to fostering an inclusive environment that welcomes applicants from diverse backgrounds and does not require candidates to meet every qualification to apply. The company upholds equal opportunity standards, including accommodation for disabilities and consideration of applicants with criminal records, consistent with relevant laws.