Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build. We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment.
🏢 About Notion
Notion is the collaborative AI workspace where teams and agents think together. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life.
🎯 The Role
You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion. You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next. We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters.
✅ Key Responsibilities
Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments, with review and mentorship from senior teammates as you ramp up.
Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
Build tooling and automation that speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements.
Take part in investigations, incident response, and postmortems, and help turn what we learn into lasting fixes.
Help define and track metrics such as coverage, MTTD, and alert quality.
Join a shared on-call rotation for incident response.
📌 Required Qualifications
3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role.
Have written or tuned detections that run in production, and care about signal quality and cutting noise.
Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly.
An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect.
Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs.
Have used SIEM, EDR, or SOAR tools in any size of environment.
Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end.
⭐ Desirable Experience
Have led purple team, blue team, or adversary emulation exercises that improved detections or telemetry.
Experience running SIEM, EDR, or SOAR platforms at large scale.
Experience building or maintaining detection-as-code workflows (version control, CI, and tests for detections).
Experience applying LLMs or agent-style tooling to security workflows.
Experience securing AI-enabled systems or endpoint tooling.
Kubernetes or container detection experience.
Background in threat intelligence, malware analysis, or digital forensics.
Contributions to the security community through research, tooling, CTFs, or talks.
Experience at a high-growth startup or AI company.
🎁 Benefits
Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role's scope and complexity, and the candidate's experience and expertise, and may vary from the range provided below. The estimated base salary range for this role is €75,000–€142,000 per year.
🛂 Visa & Eligibility
Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know.
