Security Engineer (Detection and Response)

Join Notion, a rapidly growing company that millions rely on for their most important work. As a Security Engineer specializing in Detection and Response, you will play a crucial role in protecting our platform and ensuring the trust of our users. You will design and maintain high-signal detections, build and improve the detection platform, and participate in incident response and investigations. This is a hands-on role that requires strong experience in detection engineering, security operations, and cloud security.

• Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments.
• Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
• Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
• Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments
• Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting
• Have built and operated production detections with strong signal quality and sustainable tuning processes
• Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently
• Have an offensive security mindset and have led purple team, blue team, or adversary emulation exercises that improved detections and telemetry
• Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection
• Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther
• Experience applying LLMs or agent-style tooling to security workflows
• Background in threat intelligence, malware analysis, or digital forensics
• Kubernetes or container detection experience
• Experience at a high-growth startup or AI company
• Experience securing AI-enabled systems or endpoint tooling
• Contributions to the detection engineering community through research, tooling, or talks
• You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work
• If you’re excited about this role but don’t meet every bullet, we still encourage you to apply