Description
Notion is looking for a hands-on Detection Engineer to build and operate systems and workflows to detect and respond to attacks across its cloud-native environment.
The ideal candidate will ship high-signal detections, improve the platform powering them, participate in incident response, and help shape detection and response engineering at Notion.
Responsibilities:
- Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments
- Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety
- Build tooling and automation to speed up triage, enrichment, investigation, and detection authoring
- Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements
- Participate in investigations, incident response, and postmortems
- Define and track metrics such as coverage, MTTD, and alert quality
- Join a shared on-call rotation for incident response
Requirements:
- 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a related role
- Experience writing or tuning detections that run in production
- Working knowledge of a detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther)
- Understanding of how attackers operate (MITRE ATT&CK)
- Hands-on experience with AWS, GCP, or Azure
- Experience with SIEM, EDR, or SOAR tools
- Clear writing skills for runbooks, design docs, and incident notes
Nice to Have:
- Experience leading purple team, blue team, or adversary emulation exercises
- Large-scale experience with SIEM, EDR, or SOAR platforms
- Experience building or maintaining detection-as-code workflows
- Experience applying LLMs or agent-style tooling to security workflows
- Background in threat intelligence, malware analysis, or digital forensics
Notion offers competitive cash compensation, equity, and benefits. The estimated base salary range for this role is $185,000 - $280,000 per year.