Security Engineer, Detection and Response

The role

You will build and operate systems and workflows to detect and respond to attacks across a cloud-native environment. This includes shipping high-signal detections, improving the detection platform, and participating in incident response.

What you will do

• Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments
• Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety
• Build tooling and automation for triage, enrichment, investigation, and detection authoring
• Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements
• Take part in investigations, incident response, and postmortems
• Help define and track metrics such as coverage, MTTD, and alert quality
• Join a shared on-call rotation for incident response

Required qualifications

• 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role
• Have written or tuned detections that run in production
• Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills
• An understanding of how attackers operate (for example, MITRE ATT&CK)
• Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs
• Have used SIEM, EDR, or SOAR tools in any size of environment
• Write clearly in runbooks, design docs, and incident notes
• Can own well-scoped projects end to end

Nice to have

• Have led purple team, blue team, or adversary emulation exercises
• Experience running SIEM, EDR, or SOAR platforms at large scale
• Experience building or maintaining detection-as-code workflows
• Experience applying LLMs or agent-style tooling to security workflows
• Experience securing AI-enabled systems or endpoint tooling
• Kubernetes or container detection experience
• Background in threat intelligence, malware analysis, or digital forensics
• Contributions to the security community through research, tooling, CTFs, or talks
• Experience at a high-growth startup or AI company

Benefits

• Cash compensation
• Equity

About the company

Notion is the collaborative AI workspace where teams and agents think together. Millions of individuals, small teams, and large companies run their work on Notion.