Security Engineer, Detection and Response

About the role

Who We Are Notion is the collaborative AI workspace where teams and agents think together . We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working t

Requirements

• Take part in investigations, incident response, and postmortems, and help turn what we learn into lasting fixes.
• Help define and track metrics such as coverage, MTTD, and alert quality.
• Join a shared on-call rotation for incident response.
• We're hiring across a range of experience levels. If you have some of these skills but not all, we'd still like to hear from you. 3+ years of experience in detection engineering, security operations,
• Have written or tuned detections that run in production, and care about signal quality and cutting noise.
• Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly.
• An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect.
• Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs.