Security Engineer, Notion

• Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting
• Have built and operated production detections with strong signal quality and sustainable tuning processes
• Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther
• Have an offensive security mindset and have led purple team, blue team, or adversary emulation exercises that improved detections and telemetry
• Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection
• Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments
• Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently
• You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work
• We hire talented and passionate people from a variety of backgrounds because we want our teams to reflect the wide diversity of our customers. If you’re excited about a role but your experience doesn’t align perfectly with every bullet point listed, we still encourage you to apply

Desirable

• Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build
• We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment
• You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion
• You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next
• We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters
• Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments
• Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety
• Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful
• Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements
• Participate in investigations, incident response, and postmortems that drive long-term security improvements
• Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions
• Participate in a shared on-call rotation for incident response