Security Engineer, Detection and Response

About the role

Notion is the collaborative AI workspace where teams and agents think together . We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work feels faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, humanity, and building things that last - not just shipping the next feature, but setting a standard for how modern teams (with humans and agents working together) think and execute. Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build. We're looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion's cloud-native environment. You'll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion. You'll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what's needed next. We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters What You'll Achieve Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments. Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety. Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful. Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements. Participate in investigations, incident response, and postmortems that drive long-term security improvements. Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions. Participate in a shared on-call rotation for incident response. Skills You'll Need to Bring Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting. Have built and operated production detections with strong signal quality and sustainable tuning processes. Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther. Have an offensive security mindset and have led purple team, blue team, or adversary emulation exercises that improved detections and telemetry. Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection. Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments. Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently.

Requirements

• Experience applying LLMs or agent-style tooling to security workflows.
• Experience securing AI-enabled systems or endpoint tooling.
• Kubernetes or container detection experience.
• Background in threat intelligence, malware analysis, or digital forensics.
• Contributions to the detection engineering community through research, tooling, or talks.
• Experience at a high-growth startup or AI company
• By clicking "Submit Application", I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion's Global Recruiting Privacy Policy and NYLL 144 .
• #LI-Onsite
• A Note on AI
• Equal Opportunity & Accommodations
• We hire talented and passionate people from a variety of backgrounds because we want our teams to reflect the wide diversity of our customers. If you're excited about a role but your experience doesn't align perfectly with every bullet point listed, we still encourage you to apply.
• Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision base

Benefits

Your Match

How well this role fits your profile.

Company Intel

What employees say

Worked at notion? Share your experience