Security Engineer, Detection and Response

About this role

Notion seeks a Detection Engineer to build and operate detection and response systems protecting millions of users on their cloud-native platform. You'll author high-signal detections, improve detection infrastructure, participate in incident response, and help scale detection capabilities across the organization.

What you'll do

• Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments
• Contribute to detection platform including rule lifecycle management, tuning, measurement, and safe rollouts
• Create tooling and automation for triage, enrichment, investigation, and detection authoring
• Convert threat intelligence and adversary TTPs into detections and telemetry requirements
• Participate in investigations, incident response, and postmortems to drive lasting improvements
• Join shared on-call rotation and help define key metrics like coverage, MTTD, and alert quality

What they're looking for

• Detection or query languages (Sigma, KQL, SPL, YARA-L, EQL, Panther) or SQL/Python
• Production detection engineering, security operations, or incident response experience
• Knowledge of attacker behavior and MITRE ATT&CK framework
• Hands-on AWS, GCP, or Azure experience including identity and access logs
• SIEM, EDR, or SOAR tool proficiency
• Technical writing for runbooks, design docs, and incident documentation
• End-to-end project ownership and scoping ability
• Understanding of signal quality and alert noise reduction

Benefits

• Competitive cash compensation and equity
• Onsite role in San Francisco offering collaborative environment
• Mentorship from senior detection and security engineers
• Opportunity to shape security practices at a high-growth AI company
• Access to modern cloud and security tooling at scale