Detection & Response Security Engineer (Cloud & IR)

Notion; New York (NY); On-site; USD 185,000 - 280,000; Full time

Job summary

Notion is hiring a hands-on Detection Engineer to build and operate systems that detect and respond to attacks in a cloud-native environment. You will ship high-signal detections, improve the detection platform, participate in incident response, and shape how detection scales at Notion.

You’ll collaborate with Engineering, Corporate Security, and Infrastructure, with latitude to identify gaps, prioritize investments, and implement the next set of detections and tooling.

Qualifications

• 3+ years in detection engineering, security ops, incident response, threat hunting, or related roles.
• Written or tuned detections in production with focus on signal quality.
• Knowledge of detection/query languages or strong SQL/Python and willingness to learn.

Responsibilities

• Build and tune high-signal detections across cloud, identity, endpoint, and SaaS.
• Contribute to the detection platform, including rule lifecycle and rollout safety.
• Develop tooling and automation to speed triage and investigation.
• Turn threat intel into detections and telemetry improvements.
• Participate in investigations, incident response, and postmortems.
• Define and track metrics like coverage, MTTD, and alert quality.
• Join a shared on-call rotation for incident response.

Skills

Detection engineering

Security operations

Incident response

Threat hunting

SQL or Python

MITRE ATT&CK

Cloud platforms (AWS/GCP/Azure)

SIEM/EDR/SOAR

Runbooks/Design docs

Tools

Sigma

KQL

YARA-L

Panther

Python

Job description

Notion is hiring a hands-on Detection Engineer to build and operate systems that detect and respond to attacks in a cloud-native environment. You will ship high-signal detections, improve the detection platform, participate in incident response, and shape how detection scales at Notion.

You’ll collaborate with Engineering, Corporate Security, and Infrastructure, with latitude to identify gaps, prioritize investments, and implement the next set of detections and tooling.