Security Engineer, Detection and Response

Detection engineer on Notion's security team, building and running the systems used to find and respond to attacks across its cloud-native environment, with detection treated as software engineering. The engineer writes and tunes high-signal detections for cloud, identity, endpoint and SaaS activity, improves the detection platform's rule lifecycle and rollout safety, builds triage and enrichment automation including LLM-based workflows, turns threat intelligence into detections, joins investigations, postmortems and a shared on-call rotation, and helps track coverage and MTTD.

Notion is hiring across experience levels and asks for three or more years in detection, security operations, incident response or threat hunting, a query language such as Sigma, KQL or SPL, MITRE ATT&CK knowledge and cloud log experience. The role is hybrid, three office days a week in San Francisco or New York.