Detection Engineer, Cloud Security & IR

Intermedia Lab; San Francisco (CA); On-site; USD 230,000 - 260,000; Full time

Benefits offered by this job

Competitive cash compensation

Equity

Full benefits

Job summary

Notion is hiring a hands-on Detection Engineer to build and operate detection systems across cloud and endpoints. You will ship high-signal detections, improve the platform, and participate in incident response to scale detection engineering across a cloud-native environment.

You'll collaborate with Engineering, Corporate Security, and Infrastructure, identifying gaps, prioritizing investments, and building what's needed next. Strong coding and collaboration are essential.

Qualifications

• Have 6+ years in detection engineering, security operations, incident response, or threat hunting.
• Built and operated production detections with high signal quality and sustainable tuning.
• Fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.
• Hands-on with cloud security in AWS, GCP, or Azure, including identity-focused detection.
• Experience with SIEM, EDR, and SOAR platforms at scale.
• Able to communicate designs, runbooks, and incident reports clearly.

Responsibilities

• Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS.
• Improve the detection platform with lifecycle management, tuning, and rollout safety.
• Develop tooling and automation to accelerate triage, enrichment, and investigations.
• Translate threat intel and TTPs into durable detections and telemetry.
• Participate in investigations, incident response, and post-mortems.
• Define metrics like coverage, MTTD, and alert quality to guide investments.

Skills

6+ years experience

Detections engineering

Cloud security

Detection languages

SIEM/EDR/SOAR

Incident response

Tools

Sigma

KQL

SPL

YARA-L

EQL

Panther

AWS

GCP

Azure

Kubernetes

Job description

Notion is hiring a hands-on Detection Engineer to build and operate detection systems across cloud and endpoints. You will ship high-signal detections, improve the platform, and participate in incident response to scale detection engineering across a cloud-native environment.

You'll collaborate with Engineering, Corporate Security, and Infrastructure, identifying gaps, prioritizing investments, and building what's needed next. Strong coding and collaboration are essential.