Role Overview
The Security Engineer, Detection and Response position at Notion is a full-time opportunity based in Dublin, Ireland, with remote flexibility. This role suits a dedicated professional eager to build and operate advanced systems that protect a widely used cloud-native environment against emerging attacks.
Key Responsibilities
Build and refine high-signal detection mechanisms across cloud, identity, endpoint, and SaaS ecosystems with team guidance.
Contribute directly to the detection platform by managing rule lifecycles, measuring effectiveness, and ensuring rollout safety.
Create automated tooling to streamline triage, enrichment, investigation processes, and detection authoring, including LLM-driven workflows.
Translate adversary tactics and threat intelligence into actionable detections, telemetry criteria, and stronger security responses.
Engage actively in investigations, incident response operations, and postmortems to implement permanent preventive solutions.
Define and monitor key performance indicators such as alert quality, coverage levels, and mean time to detect.
Participate in a shared on-call rotation to manage and mitigate security incidents.
Requirements
Bring a minimum of 3 years of hands-on professional background in detection engineering, security operations, threat hunting, incident response, or related software engineering domains.
Demonstrated history of writing or optimizing production-level detections focused on signal quality and noise reduction.
Working proficiency in at least one specialized query or detection language like Sigma, KQL, SPL, YARA-L, EQL, or Panther, or alternatively strong foundational skills in Python or SQL.
Solid comprehension of adversary frameworks such as MITRE ATT&CK to guide detection strategies.
Practical experience working with major cloud platforms including AWS, GCP, or Azure, with familiarity regarding identity and access logs.
Prior use of standard security tools such as SIEM, EDR, or SOAR solutions.
Strong written communication abilities for authoring technical runbooks, design documentation, and incident logs.
Nice to Have
Background leading blue team, purple team, or adversary emulation exercises to enhance telemetry.
Experience managing large-scale SIEM, EDR, or SOAR infrastructure.
Previous involvement in detection-as-code workflows involving version control and continuous integration testing.
Practical knowledge of applying LLMs or agent tooling toward security operations.
Familiarity with securing containerized environments, Kubernetes, or AI-enabled systems.
Prior exposure to digital forensics, malware analysis, or formal threat intelligence.
Community contributions such as public research, speaking engagements, security tooling, or CTFs.
Past employment history within high-growth startups or artificial intelligence companies.
Skills and Tools
Python
SQL
AWS, GCP, and Azure
Kubernetes
LLM workflows
SIEM, EDR, and SOAR tools
Detection languages including Sigma, KQL, SPL, YARA-L, EQL, and Panther
Salary and Benefits
Estimated base salary range from €75,000 to €142,000 per year.
Highly competitive cash compensation alongside equity options.
Benefits package determined by factors such as location, role complexity, and candidate expertise.
About the Company
Notion builds a collaborative workspace where teams and agents gather knowledge, projects, and meetings into a single unified platform. Millions of individuals and enterprises rely on the workspace to reduce fragmentation and streamline daily operations. Employees, known as Notinos, work together to set new standards for human collaboration in the artificial intelligence era.
How to Apply
Interested candidates should visit the official Notion careers page to submit an application and review further details about the recruitment process.
