Security Engineer, Detection and Response

About Us

Notion is an AI-powered collaborative workspace where teams and agents converge to organize knowledge, manage projects, conduct meetings, and integrate AI tools seamlessly. It serves millions of users ranging from individuals to large enterprises, aiming to streamline work by reducing fragmentation and improving clarity.

Our employees, known as Notinos, embody the vision of transforming how humans collaborate in the AI era. Instead of focusing on incremental features, each team is dedicated to setting a new benchmark in how work is done, emphasizing craftsmanship, lasting value, and humanity in technology. Our mission centers around providing customers with more time for meaningful work by leveraging innovative AI and automation.

Role Overview

With millions relying on Notion for critical tasks, safeguarding that trust is paramount. We seek a proactive Detection Engineer to engineer and maintain detection systems and workflows that identify and counteract attacks across Notion's cloud-native landscape.

The role involves creating precise detection mechanisms, enhancing detection platforms, engaging in incident response, and influencing scalable detection and response engineering practices at Notion. Collaboration with Engineering, Corporate Security, and Infrastructure teams will be key, alongside identifying security gaps and prioritizing improvements.

We approach detection and response as a discipline akin to software engineering—treating detections as code, platforms as products, and emphasizing the importance of metrics.

Key Responsibilities

• Create and manage effective detection rules spanning cloud environments, identities, endpoints, and SaaS applications.
• Develop and refine the detection platform, focusing on rule lifecycle, tuning, performance measurement, and secure deployment.
• Design tooling and automate processes to streamline triage, enrichment, investigation, and creation of detection logic, including utilizing large language models (LLMs) where beneficial.
• Convert threat intelligence and adversary tactics into robust detections, telemetry needs, and improved response strategies.
• Contribute to investigations, handle incident responses, and conduct postmortem analyses to enhance security measures.
• Establish and monitor metrics such as coverage, mean time to detect (MTTD), and alert quality to inform strategic decisions.
• Participate in a shared on-call rotation supporting incident management.

Required Qualifications and Experience

• Minimum of six years in detection engineering, security operations, incident response, or threat hunting roles.
• Experience developing and running in-production detections with high fidelity and maintainable tuning workflows.
• Proficiency in detection query languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.
• A strong offensive security perspective, having led purple team, blue team, or adversarial emulation exercises that enhanced detection and telemetry capabilities.
• Solid understanding of cloud security in environments like AWS, GCP, or Azure, with a focus on identity-related attack detection.
• Hands-on expertise using SIEM, EDR, and SOAR technologies in large-scale settings.
• Excellent communication skills demonstrated through writing design documentation, runbooks, and incident reports, plus an ability to independently drive projects.

Preferred Additional Skills

• Experience integrating LLMs or agent-based tooling into security processes.
• Knowledge of securing AI systems or endpoint security tools.
• Familiarity with Kubernetes or container detection methods.
• Background in threat intelligence, malware analysis, or digital forensics.
• Contributions to the detection engineering field via research, development, or presentations.
• Experience working within startups or AI-focused companies.

Compensation

Notion offers competitive cash salaries, equity options, and benefits. Salary ranges for this position depend on factors including location, role complexity, and candidate experience and expertise. The anticipated base salary for this role falls between €127,000 and €142,000 annually.

Company Philosophy on AI

While deep AI expertise is not mandatory for every role, all team members are expected to be intellectually curious, keen to experiment and explore, and enthusiastic about leveraging AI as a collaborative tool in their work. AI is viewed as a means to enhance thinking and simplify work rather than a mere novelty.

Equal Opportunity Employer Statement

We celebrate diversity and encourage applications from all qualified candidates regardless of background. Notion does not discriminate based on legally protected attributes and provides reasonable accommodations upon request during the hiring process. Qualified applicants with criminal records are fairly considered, consistent with laws.