# Security Engineer, Detection and Response

**Company**: Notion
**Location**: Dublin
**Work arrangement**: hybrid
**Job type**: full-time
**Salary**: €75,000–€142,000 per year
**Category**: Security
**Industry**: Technology

**Apply**: https://jobs.ashbyhq.com/notion/fbcaf076-830e-4daf-ad39-1e0e8ce9f89c?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_b6dd57ef-068

## Description

Notion is seeking a hands-on Detection Engineer to build and operate systems and workflows for detecting and responding to attacks across its cloud-native environment.

The ideal candidate will ship high-signal detections, improve the detection platform, participate in incident response, and help shape the scaling of detection and response engineering at Notion.

Responsibilities:

- Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments

- Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety

- Build tooling and automation for triage, enrichment, investigation, and detection authoring

- Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements

- Participate in investigations, incident response, and postmortems

- Help define and track metrics such as coverage, MTTD, and alert quality

- Join a shared on-call rotation for incident response

Requirements:

- 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role

- Experience writing or tuning detections that run in production

- Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther)

- Understanding of how attackers operate (e.g., MITRE ATT&CK)

- Hands-on experience with AWS, GCP, or Azure, including identity and access logs

- Experience with SIEM, EDR, or SOAR tools

- Clear writing skills for runbooks, design docs, and incident notes

Nice to Have:

- Experience leading purple team, blue team, or adversary emulation exercises

- Large-scale experience with SIEM, EDR, or SOAR platforms

- Experience building or maintaining detection-as-code workflows

- Experience applying LLMs or agent-style tooling to security workflows

- Background in threat intelligence, malware analysis, or digital forensics

Notion offers a competitive salary range of €75,000–€142,000 per year, along with equity and benefits.

## Skills

### Required
- detection engineering
- security operations
- incident response
- threat hunting
- cloud security
- identity and access management
- SIEM
- EDR
- SOAR
- Sigma
- KQL
- SPL
- YARA-L
- EQL
- Panther
- SQL
- Python
- MITRE ATT&CK
- AWS
- GCP
- Azure

### Nice to have
- purple team
- blue team
- adversary emulation
- detection-as-code
- LLMs
- agent-style tooling
- threat intelligence
- malware analysis
- digital forensics
- Kubernetes
- container detection

---

Source: [Apply at jobs.ashbyhq.com](https://jobs.ashbyhq.com/notion/fbcaf076-830e-4daf-ad39-1e0e8ce9f89c?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)