Security Engineer, Detection and Response

About Notion

Notion creates a collaborative AI workspace enabling teams and agents to work together effectively. It integrates knowledge, projects, meetings, and AI tools in one place, streamlining work for millions worldwide. Notion employees, known as Notinos, focus on crafting durable solutions and enhancing human-centric work in the AI era, aiming to improve productivity by automating busy work and managing AI agents intelligently.

Role Overview

This position focuses on protecting the trust users place in Notion by developing and managing advanced detection and response systems within the cloud-native environment. The Security Engineer will build high-impact detections, maintain and evolve the detection platform, engage in incident response, and contribute to the scalability of detection engineering practices. Collaboration with Engineering, Corporate Security, and Infrastructure teams is essential to identify security gaps and prioritize necessary developments.

Key Responsibilities

• Develop and maintain precise detections across cloud services, identity systems, endpoints, and SaaS platforms.
• Enhance the detection infrastructure including the management of detection rules, tuning, measuring effectiveness, and ensuring safe deployment.
• Create automation and tools to speed up incident triage, enrichment, investigation, and detection authoring, including applying large language model (LLM) techniques where beneficial.
• Convert threat intelligence and adversary tactics into reliable detections, needed telemetry, and improved response processes.
• Engage in investigations, incident handling, and post-incident reviews to enhance long-term security resilience.
• Establish and monitor metrics like coverage, mean time to detect (MTTD), and alert accuracy to inform resource allocation.
• Participate in an on-call rotation for responding to security incidents.

Required Qualifications and Skills

• Minimum six years of experience in detection engineering, security operations, incident response, or threat hunting.
• Proven track record of creating and managing production detections with high signal quality and ongoing tuning procedures.
• Proficiency in detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.
• Hands-on experience in offensive security activities, having led purple team, blue team, or adversary emulation exercises that improved security telemetry and detection.
• Strong expertise in cloud security on platforms like AWS, GCP, or Azure, focusing on identity attack detection.
• Operational knowledge with SIEM, EDR, and SOAR solutions in large environments.
• Ability to produce clear documentation including design papers, runbooks, and incident reports, and independently manage projects.

Preferred Attributes

• Experience integrating LLMs or agent-based tools into security workflows.
• Expertise in securing AI-related systems or endpoint detection tools.
• Familiarity with Kubernetes or container detection methods.
• A background in threat intelligence, malware analysis, or digital forensics.
• Contributions to detection engineering community via research, tooling, or presentations.
• Previous work experience at rapidly scaling startups or AI-focused companies.

Compensation and Policies

Notion offers competitive salary packages, equity options, and comprehensive benefits. The annual base salary for this role is estimated between €127,000 and €142,000, contingent on factors like location, role complexity, and candidate experience.

Additional Notes

Notion values intellectual curiosity and expects employees to leverage AI as a collaborative tool without requiring deep AI expertise for this role. The company welcomes applicants from diverse backgrounds and is committed to equal employment opportunities, supporting candidates through accommodations and inclusive hiring policies. Applicants with arrest or conviction records will be considered in compliance with applicable laws.