Security Engineer (Detection and Response)

Join Notion, a company trusted by millions for their most important work. As a Security Engineer focused on Detection and Response, you will build and operate systems to detect and respond to attacks in Notion's cloud-native environment. You will work closely with various teams, contribute to the detection platform, and participate in incident response. This role requires a strong understanding of detection engineering, security operations, and incident response, as well as experience with cloud environments and security tools.

• Construire et exploiter les systèmes et les flux de travail utilisés pour détecter et répondre aux attaques dans l'environnement cloud de Notion.
• Participer à la réponse aux incidents, à l'amélioration de la plateforme de détection et à la mise en œuvre d'automatisations pour accélérer le triage et l'enrichissement.
• Collaborer avec les équipes d'ingénierie, de sécurité d'entreprise et d'infrastructure pour identifier les lacunes et prioriser les investissements.

• Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly
• An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect
• 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role
• Have written or tuned detections that run in production, and care about signal quality and cutting noise
• We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply
• Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end
• Have used SIEM, EDR, or SOAR tools in any size of environment
• We're hiring across a range of experience levels. If you have some of these skills but not all, we'd still like to hear from you
• Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs
• Kubernetes or container detection experience
• Experience applying LLMs or agent-style tooling to security workflows
• Experience running SIEM, EDR, or SOAR platforms at large scale
• Experience building or maintaining detection-as-code workflows (version control, CI, and tests for detections)
• Have led purple team, blue team, or adversary emulation exercises that improved detections or telemetry
• Experience securing AI-enabled systems or endpoint tooling
• Contributions to the security community through research, tooling, CTFs, or talks
• Background in threat intelligence, malware analysis, or digital forensics
• Experience at a high-growth startup or AI company