Cloud-Native Detection & Response Security Engineer

Notion; San Francisco (CA); On-site; USD 185,000 - 280,000; Full time

Job summary

Notion is seeking a hands-on Detection Engineer to build and operate systems that detect and respond to attacks across its cloud-native environment. You will ship high-signal detections, improve the platform, participate in incident response, and shape how detection scales.

You’ll work with Eng, Corporate Security, and Infra, with latitude to identify gaps and build what’s needed next. You’ll translate threat intel into detections, contribute to telemetry requirements, and help define metrics

Qualifications

• 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or related roles.
• Detections written or tuned for production with focus on signal quality and noise reduction.
• Experience with at least one detection/query language or strong SQL/Python skills and quick learner.
• Understanding of attacker tactics (e.g., MITRE ATT&CK) used to decide what to detect.
• Hands-on experience with AWS, GCP, or Azure, including identity/logs access.
• Experience with SIEM/EDR/SOAR in various environments.
• Ability to communicate clearly in runbooks, design docs, and incident notes; own end-to-end projects.

Responsibilities

• Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments with mentorship as you ramp up.
• Contribute to the detection platform with rule lifecycle, tuning, measurement, and safe rollout.
• Develop tooling and automation to speed triage, enrichment, investigation, and detection authoring (LLM workflows when useful).
• Translate threat intel and adversary TTPs into detections and telemetry requirements.
• Participate in investigations, IR, and postmortems; implement lasting fixes from learnings.
• Define and track metrics like coverage, MTTD, and alert quality.
• Join on-call rotation for incident response.

Skills

detection engineering

incident response

threat hunting

Python/SQL

cloud logs

SIEM/EDR/SOAR

runbooks/docs

Tools

Sigma

KQL

SPL

YARA-L

EQL

Panther

SQL

Python

Job description

Notion is seeking a hands-on Detection Engineer to build and operate systems that detect and respond to attacks across its cloud-native environment. You will ship high-signal detections, improve the platform, participate in incident response, and shape how detection scales.

You’ll work with Eng, Corporate Security, and Infra, with latitude to identify gaps and build what’s needed next. You’ll translate threat intel into detections, contribute to telemetry requirements, and help define metrics