Security Engineer, Detection and Response

Stack

Responsibilities

• ▹Design and maintain high-signal detections across cloud, identity, endpoint, and SaaS environments
• ▹Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety
• ▹Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows
• ▹Translate threat intelligence and adversary TTPs into durable detections and telemetry requirements
• ▹Participate in investigations, incident response, and postmortems
• ▹Define and track key metrics such as coverage, MTTD, and alert quality
• ▹Participate in a shared on-call rotation for incident response

Requirements

• ▹6+ years of experience in detection engineering, security operations, incident response, or threat hunting
• ▹Experience building and operating production detections with strong signal quality and sustainable tuning
• ▹Fluency in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther
• ▹An offensive security mindset, with experience leading purple team, blue team, or adversary emulation exercises
• ▹Strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection
• ▹Hands-on experience with SIEM, EDR, and SOAR platforms in large-scale environments
• ▹Clear communication through design docs, runbooks, and incident reports, driving projects independently

Nice to have

• ▹Experience applying LLMs or agent-style tooling to security workflows
• ▹Experience securing AI-enabled systems or endpoint tooling
• ▹Kubernetes or container detection experience
• ▹Background in threat intelligence, malware analysis, or digital forensics
• ▹Contributions to the detection engineering community through research, tooling, or talks
• ▹Experience at a high-growth startup or AI company

Soft skills

What we offer

• ▹Highly competitive cash compensation, equity, and benefits
• ▹San Francisco or New York City office, with Anchor Days in-office

About the company

Notion is the collaborative AI workspace where teams and agents think together, bringing docs, projects, calendars, and email into one place with AI built in. Millions of users, from individuals to large organizations like Toyota, Figma, and OpenAI, rely on Notion.