Latest AI JobsBrowse Jobs
Notion logo

Security Engineer, Detection and Response

NotionSan Francisco, CaliforniaSecurity
Apply on company site
Salary
$185K - $280K
Job type
Full-time
Work mode
Remote
Posted
28 Sept 2026
Status
Open · checked 7d ago

About this role

Notion seeks a Security Engineer, Detection and Response to build and operate threat detection systems in San Francisco, California or via remote work arrangements. This full-time role suits a hands-on security professional who wants to protect trust across a cloud-native workspace platform.

Role Overview

As a Detection Engineer at Notion, the focus centers on building and operating systems and workflows to detect and address attacks across a cloud-native environment. Team members ship high-signal detections, refine underlying platforms, participate in incident response, and help scale detection engineering practices. Collaboration happens closely with Engineering, Corporate Security, and Infrastructure teams to identify gaps and build necessary solutions. Detection and response is treated as a software engineering discipline where detections act as code and platforms act as products.

Key Responsibilities

Build and tune high-signal detections spanning cloud, identity, endpoint, and SaaS environments with team mentorship.
Contribute to the detection platform through rule lifecycle management, tuning, measurement, and rollout safety.
Develop tooling and automation to accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows.
Transform threat intelligence and adversary tactics, techniques, and procedures into detections, telemetry requirements, and fixes.
Participate in investigations, incident response, and postmortems to implement lasting fixes from lessons learned.
Define and track metrics such as coverage, mean time to detect, and alert quality.
Participate in a shared on-call rotation for incident response.

Requirements

At least 3 years of experience in detection engineering, security operations, incident response, threat hunting, or a related security or software engineering field.
Experience writing or tuning production-ready detections with a strong focus on signal quality and noise reduction.
Working knowledge of at least one detection or query language like Sigma, KQL, SPL, YARA-L, EQL, or Panther, or robust SQL or Python skills.
Understanding of attacker methodologies, such as the MITRE ATT&CK framework, to guide detection strategy.
Hands-on experience working with AWS, GCP, or Azure, including identity and access logs.
Practical background using SIEM, EDR, or SOAR tools within any environment size.
Clear written communication skills demonstrated through runbooks, design docs, and incident notes, with the ability to own well-scoped projects end-to-end.

Nice to Have

Experience leading purple team, blue team, or adversary emulation exercises to enhance detections or telemetry.
Large-scale operational experience with SIEM, EDR, or SOAR platforms.
Background in building or maintaining detection-as-code workflows involving version control, CI, and testing.
Practical application of LLMs or agent-style tooling for security workflows.
Experience securing AI-enabled systems, endpoint tooling, or Kubernetes and container environments.
Background in threat intelligence, malware analysis, or digital forensics.
Contributions to the security community via research, tooling, CTFs, or public speaking.
Previous experience working at high-growth startups or AI companies.

Skills and Tools

Python
SQL
AWS, GCP, or Azure
Kubernetes
LLM workflows
SIEM, EDR, and SOAR tools
Detection and query languages (Sigma, KQL, SPL, YARA-L, EQL, Panther)

Salary and Benefits

Notion offers competitive cash compensation, equity, and comprehensive benefits. For candidates based in San Francisco, California or New York City, the estimated base salary range is $185,000 to $280,000 per year, determined by factors such as location, role scope, complexity, and candidate expertise.

About the Company

Notion provides a collaborative AI workspace where teams and agents think together by housing knowledge, projects, meetings, and AI tools in one unified platform. Millions of individuals, small teams, and large enterprises rely on the platform to run their work, supported by employees known as Notinos who act as customer zero for the future of work.

How to Apply

Interested candidates should visit the official Notion careers page to submit an application for this position.

Skills and tech stack

PythonLLMLLMsKubernetesAWSGCPAzureSQL

Questions candidates ask

What is the primary focus of the Security Engineer, Detection and Response role?

The role focuses on building and operating systems and workflows to detect and respond to attacks across Notion's cloud-native environment, treating detection engineering as a software discipline.

What level of experience is required for this position?

Candidates should have 3 or more years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role.

Is remote work supported for this job?

Yes, the position offers remote flexibility alongside a San Francisco, California location option.

What technical skills or query languages are expected?

Candidates need working knowledge of at least one detection or query language such as Sigma, KQL, SPL, YARA-L, EQL, or Panther, or strong SQL or Python skills alongside cloud platform experience in AWS, GCP, or Azure.

What is the salary range for this role in San Francisco?

The estimated base salary range for candidates based in San Francisco or New York City is $185,000 to $280,000 per year, depending on experience and other factors.

Ready to apply?

The application is on the official Notion careers page.

Apply on company site