Detection & Response Engineer — Cloud Security (SF)

Monograph; San Francisco (CA); On-site; USD 230,000 - 260,000; Full time

Job summary

Notion is a collaborative AI workspace used by teams to manage knowledge, projects, meetings, and AI tools. We’re seeking a hands-on Detection Engineer to build and operate detections across our cloud-native environment, ship high-signal detections, and support incident response.

You will collaborate with Engineering, Corporate Security, and Infrastructure, shape detection engineering at scale, and define metrics like MTTD and alert quality to guide investment.

Qualifications

• 6+ years of experience in detection engineering, security operations, incident response, or threat hunting.
• Built and operated production detections with high signal quality and sustainable tuning.
• Fluent in detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.
• Offensive security mindset with purple/blue team or adversary emulation exercises that improved detections.
• Strong cloud security experience in AWS, GCP, or Azure, including identity-focused detection.
• Hands-on with SIEM, EDR, and SOAR platforms in large-scale environments.
• Clear communication through design docs, runbooks, and incident reports, and independent project driving.

Responsibilities

• Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments.
• Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
• Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
• Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements.
• Participate in investigations, incident response, and postmortems that drive long-term security improvements.
• Define and track metrics such as coverage, MTTD, and alert quality to guide investment decisions.
• Participate in a shared on-call rotation for incident response.

Skills

Detection engineering

Incident response

Threat hunting

Cloud security

SIEM/EDR/SOAR

Communication

Purple/blue team exercises

Tools

SIEM

EDR

SOAR

Job description

Notion is a collaborative AI workspace used by teams to manage knowledge, projects, meetings, and AI tools. We’re seeking a hands-on Detection Engineer to build and operate detections across our cloud-native environment, ship high-signal detections, and support incident response.

You will collaborate with Engineering, Corporate Security, and Infrastructure, shape detection engineering at scale, and define metrics like MTTD and alert quality to guide investment.