Security Engineer (Detection and Response)

As a Security Engineer focused on Detection and Response, you will play a crucial role in protecting the trust that users place in our platform. You will build and operate systems and workflows to detect and respond to attacks across Notion's cloud-native environment.

About Notion

Notion, a rapidly growing company that millions of people rely on for their most important work.

Responsibilities

• This hands-on role involves shipping high-signal detections, improving the detection platform, participating in incident response, and shaping the future of detection and response engineering at Notion.
• You will work closely with various teams, including Engineering, Corporate Security, and Infrastructure, and have the opportunity to identify gaps, prioritize investments, and build what is needed next.
• Construire et exploiter les systèmes et les flux de travail utilisés pour détecter et répondre aux attaques dans l'environnement cloud de Notion.
• Participer à la réponse aux incidents, à l'amélioration de la plateforme de détection et à la mise en œuvre d'automatisations pour accélérer le triage et l'enrichissement.
• Collaborer avec les équipes d'ingénierie, de sécurité d'entreprise et d'infrastructure pour identifier les lacunes et prioriser les investissements.
• An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect

Requirements

• 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role
• Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs
• Have used SIEM, EDR, or SOAR tools in any size of environment
• Have written or tuned detections that run in production, and care about signal quality and cutting noise
• Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end

Preferred

• Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly
• Experience running SIEM, EDR, or SOAR platforms at large scale
• Experience building or maintaining detection-as-code workflows (version control, CI, and tests for detections)
• Experience applying LLMs or agent-style tooling to security workflows
• Experience securing AI-enabled systems or endpoint tooling

Kubernetes or container detection experience

• Background in threat intelligence, malware analysis, or digital forensics
• Contributions to the security community through research, tooling, CTFs, or talks
• Experience at a high-growth startup or AI company

Pay

EUR 75,000 - 142,000

• If you’re excited about this role but don’t meet every bullet, we still encourage you to apply
• Have led purple team, blue team, or adversary emulation exercises that improved detections or telemetry