N
Notion
Security Engineer (Detection and Response)
Skills
Google Cloud PlatformCybersecurityAIAWSKubernetesAzure
23 days ago
Share this opportunity
Share this opportunity to other talents of your network:
✓ Offer them a visibility boost with clients.
✓ Help your contacts find their next job.
Important information
Contract type:
Permanent
Salary:
€127,000 – €142,000 / year
Location:
United States
Work mode:
Onsite
Published on:
30 September 2026
What they need
- Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build
- We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment
- You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion
- You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next
- We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters
- Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments
- Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety
- Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful
- Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements
- Participate in investigations, incident response, and postmortems that drive long-term security improvements
- Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions
- Participate in a shared on-call rotation for incident response- Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther
- Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently
- Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection
- Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments
- Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting
- Have an offensive security mindset and have led purple team, blue team, or adversary emulation exercises that improved detections and telemetry
- Have built and operated production detections with strong signal quality and sustainable tuning processes
- You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work
- We hire talented and passionate people from a variety of backgrounds because we want our teams to reflect the wide diversity of our customers. If you’re excited about a role but your experience doesn’t align perfectly with every bullet point listed, we still encourage you to apply
- Kubernetes or container detection experience
- Contributions to the detection engineering community through research, tooling, or talks
- Experience at a high-growth startup or AI company
- Experience applying LLMs or agent-style tooling to security workflows
- Experience securing AI-enabled systems or endpoint tooling
- Background in threat intelligence, malware analysis, or digital forensics
Other offers great for you!
These companies are also looking for great profiles
V
Visian
Ingénieur Sécurité Poste de Travail / Endpoint Security Engineer (H/F)
650
Freelance
Paris, France
Hybrid
Skills
CybersecurityIntuneendpointendpoint securitymicrosoft defender
15 days ago
Quick apply
E
Ecocea
Ingénieur Sécurité Réseau
Freelance
Toulouse, France
Onsite, Hybrid
Skills
Network securityFirewallsWAFFortiGateProxySecurity policy enforcement
14 days ago
Quick apply
V
Visian
Ingénieur Sécurité PKI et Automatisation
Freelance
Paris, France
Hybrid
Skills
PKICryptographyStrong authenticationSmart cardsAutomationLevel 3 support
3 days ago
Quick apply
No company information available.