Detection & Response Security Engineer (Cloud & IR)

Notion; New York (NY); Hybrid; USD 185,000 - 280,000; Full time

Job summary

Notion is seeking a hands-on Detection Engineer to build and operate the systems that detect and respond to attacks across our cloud-native environment. You will ship detections, improve the platform, and participate in incident response while shaping scalable detection engineering practices.

You will collaborate with Engineering and Security teams, turning threat intel into detections and telemetry, and helping drive incident analyses and postmortems across Notion's growing security program.

Qualifications

• 3+ years in detection engineering, security operations, incident response, threat hunting, or related security/software engineering role.
• Wrote or tuned detections in production with focus on signal quality and cutting noise.
• Familiar with at least one detection language or strong SQL/Python and the drive to learn quickly.
• Understanding of attacker techniques (MITRE ATT&CK) and how to apply them to what to detect.
• Hands-on experience with AWS, GCP, or Azure, including identity/access logs.
• Experience with SIEM/EDR/SOAR in any environment.
• Ability to write clearly in runbooks, design docs, and incident notes; capable of owning well-scoped projects end to end.

Responsibilities

• Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments with mentorship.
• Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
• Build tooling and automation for triage, enrichment, investigation, and detection authoring, including LLM-based workflows.
• Translate threat intelligence and adversary TTPs into detections and telemetry needs.
• Participate in investigations, incident response, and postmortems; turn findings into lasting fixes.
• Define and track metrics such as coverage, MTTD, and alert quality.
• Join a shared on-call rotation for incident response.

Skills

Detection engineering

Security operations

Incident response

Threat hunting

Detection languages

Cloud logs

Runbooks & docs

Python/SQL

Education

Bachelor's degree or equivalent

Tools

SIEM

EDR

SOAR

AWS/GCP/Azure

Job description

Notion is seeking a hands-on Detection Engineer to build and operate the systems that detect and respond to attacks across our cloud-native environment. You will ship detections, improve the platform, and participate in incident response while shaping scalable detection engineering practices.

You will collaborate with Engineering and Security teams, turning threat intel into detections and telemetry, and helping drive incident analyses and postmortems across Notion's growing security program.