Security Engineer, Detection and Response

Stack

Responsibilities

• ▹Build and tune high-signal detections across cloud, identity, endpoint and SaaS environments, with review and mentorship from senior teammates as you ramp up
• ▹Contribute to the detection platform, including rule lifecycle management, tuning, measurement and rollout safety
• ▹Build tooling and automation that speed up triage, enrichment, investigation and detection authoring, including LLM-based workflows where useful
• ▹Turn threat intelligence and adversary TTPs into detections, telemetry requirements and response improvements
• ▹Take part in investigations, incident response and postmortems, and turn what you learn into lasting fixes
• ▹Help define and track metrics such as coverage, MTTD and alert quality
• ▹Join a shared on-call rotation for incident response

Requirements

• ▹3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role
• ▹Have written or tuned detections that run in production, and care about signal quality and cutting noise
• ▹Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL or Panther), or strong SQL or Python skills and the drive to learn one quickly
• ▹An understanding of how attackers operate (for example, MITRE ATT&CK) and the ability to use it to decide what to detect
• ▹Hands-on experience with AWS, GCP or Azure, ideally including identity and access logs
• ▹Have used SIEM, EDR or SOAR tools in any size of environment
• ▹Write clearly in runbooks, design docs and incident notes, and can own well-scoped projects end to end

Nice to have

• ▹Have led purple team, blue team or adversary emulation exercises that improved detections or telemetry
• ▹Experience running SIEM, EDR or SOAR platforms at large scale
• ▹Experience building or maintaining detection-as-code workflows (version control, CI and tests for detections)
• ▹Experience applying LLMs or agent-style tooling to security workflows
• ▹Experience securing AI-enabled systems or endpoint tooling
• ▹Kubernetes or container detection experience
• ▹Background in threat intelligence, malware analysis or digital forensics
• ▹Contributions to the security community through research, tooling, CTFs or talks
• ▹Experience at a high-growth startup or AI company

Soft skills

What we offer

• ▹Highly competitive cash compensation, equity and benefits
• ▹Estimated base salary range of €75,000–€142,000 per year

About the company

Notion is the collaborative AI workspace where teams and agents think together, bringing knowledge, projects, meetings and AI tools into one place. Millions of individuals, small teams and large companies run their work on it.