jobapplier

Security Engineer (Detection and Response)

Notion

Skills

Required

  • detection / query language
  • detection engineering
  • security operations
  • incident response
  • SIEM / EDR / SOAR
  • Sigma / KQL / SPL / YARA-L / EQL / Panther
  • SQL / Python
  • MITRE
  • ATT&CK
  • threat hunting
  • AWS / GCP / Azure
  • identity and access logs
  • docs

Preferred

  • Kubernetes / container detection
  • LLMs / agent-style tooling
  • security workflows
  • securing AI-enabled systems / endpoint tooling
  • threat intelligence / malware analysis / digital forensics

Join Notion, a company trusted by millions for their most important work. As a Security Engineer focused on Detection and Response, you will build and operate systems to detect and respond to attacks in Notion's cloud-native environment. You will work closely with various teams, contribute to the detection platform, and participate in incident response. This role requires a strong understanding of detection engineering, security operations, and incident response, as well as experience with cloud environments and security tools.

We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply

We're hiring across a range of experience levels. If you have some of these skills but not all, we'd still like to hear from you

Responsibilities

  • Construire et exploiter les systèmes et les flux de travail utilisés pour détecter et répondre aux attaques dans l'environnement cloud de Notion.
  • Participer à la réponse aux incidents, à l'amélioration de la plateforme de détection et à la mise en œuvre d'automatisations pour accélérer le triage et l'enrichissement.
  • Collaborer avec les équipes d'ingénierie, de sécurité d'entreprise et d'infrastructure pour identifier les lacunes et prioriser les investissements.

Requirements

  • Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly
  • An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect
  • 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role
  • Have written or tuned detections that run in production, and care about signal quality and cutting noise
  • Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end
  • Have used SIEM, EDR, or SOAR tools in any size of environment
  • Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs
  • Experience building or maintaining detection-as-code workflows (version control, CI, and tests for detections)
  • Have led purple team, blue team, or adversary emulation exercises that improved detections or telemetry

Preferred

Kubernetes or container detection experience

  • Experience applying LLMs or agent-style tooling to security workflows
  • Experience running SIEM, EDR, or SOAR platforms at large scale

Experience securing AI-enabled systems or endpoint tooling

  • Contributions to the security community through research, tooling, CTFs, or talks
  • Background in threat intelligence, malware analysis, or digital forensics

Pay

USD 185,000 - 280,000

Benefits

  • Experience at a high-growth startup or AI company

Every job at Notion