Description
Notion is seeking a hands-on Detection Engineer to build and operate systems and workflows for detecting and responding to attacks across its cloud-native environment.
The ideal candidate will ship high-signal detections, improve the detection platform, participate in incident response, and help shape the scaling of detection and response engineering at Notion.
Responsibilities:
- Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments
- Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety
- Build tooling and automation for triage, enrichment, investigation, and detection authoring
- Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements
- Participate in investigations, incident response, and postmortems
- Help define and track metrics such as coverage, MTTD, and alert quality
- Join a shared on-call rotation for incident response
Requirements:
- 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role
- Experience writing or tuning detections that run in production
- Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther)
- Understanding of how attackers operate (e.g., MITRE ATT&CK)
- Hands-on experience with AWS, GCP, or Azure, including identity and access logs
- Experience with SIEM, EDR, or SOAR tools
- Clear writing skills for runbooks, design docs, and incident notes
Nice to Have:
- Experience leading purple team, blue team, or adversary emulation exercises
- Large-scale experience with SIEM, EDR, or SOAR platforms
- Experience building or maintaining detection-as-code workflows
- Experience applying LLMs or agent-style tooling to security workflows
- Background in threat intelligence, malware analysis, or digital forensics
Notion offers a competitive salary range of €75,000–€142,000 per year, along with equity and benefits.