# Security Engineer, Detection and Response

**Company**: Notion
**Location**: San Francisco, California
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: $185,000 - $280,000 per year
**Category**: Security
**Industry**: Technology

**Apply**: https://jobs.ashbyhq.com/notion/06e1d3a8-2706-4ed9-9fe6-8b69607de18e?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_47823922-d2c

## Description

Notion is looking for a hands-on Detection Engineer to build and operate systems and workflows to detect and respond to attacks across its cloud-native environment.

The ideal candidate will ship high-signal detections, improve the platform powering them, participate in incident response, and help shape detection and response engineering at Notion.

Responsibilities:

- Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments

- Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety

- Build tooling and automation to speed up triage, enrichment, investigation, and detection authoring

- Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements

- Participate in investigations, incident response, and postmortems

- Define and track metrics such as coverage, MTTD, and alert quality

- Join a shared on-call rotation for incident response

Requirements:

- 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a related role

- Experience writing or tuning detections that run in production

- Working knowledge of a detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther)

- Understanding of how attackers operate (MITRE ATT&CK)

- Hands-on experience with AWS, GCP, or Azure

- Experience with SIEM, EDR, or SOAR tools

- Clear writing skills for runbooks, design docs, and incident notes

Nice to Have:

- Experience leading purple team, blue team, or adversary emulation exercises

- Large-scale experience with SIEM, EDR, or SOAR platforms

- Experience building or maintaining detection-as-code workflows

- Experience applying LLMs or agent-style tooling to security workflows

- Background in threat intelligence, malware analysis, or digital forensics

Notion offers competitive cash compensation, equity, and benefits. The estimated base salary range for this role is $185,000 - $280,000 per year.

## Skills

### Required
- detection engineering
- security operations
- incident response
- threat hunting
- cloud security
- SIEM
- EDR
- SOAR

### Nice to have
- purple team
- blue team
- adversary emulation
- detection-as-code
- LLMs
- agent-style tooling
- threat intelligence
- malware analysis
- digital forensics

---

Source: [Apply at jobs.ashbyhq.com](https://jobs.ashbyhq.com/notion/06e1d3a8-2706-4ed9-9fe6-8b69607de18e?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)