Role in brief
Notion seeks a Security Engineer for detection and response in a cloud-native setting. The role involves building detection systems and improving security measures. Candidates with extensive experience in security operations and cloud environments should apply.
About the role
As a Security Engineer at Notion, you will focus on designing and maintaining detection systems across various environments, including cloud and endpoints. Your work will enhance the company's ability to identify and respond to security threats effectively.
You will collaborate closely with other teams to implement robust security measures that protect user trust. Success in this role will be measured by the quality of detections, incident response efficiency, and the overall improvement of Notion's security posture.
The salary range for this position is between $230,000 and $260,000 per year for roles based in specific locations.
Skills that matter here
- detection engineering: This role requires designing and maintaining high-quality detection systems.
- security operations: You will be involved in incident response and security investigations.
- cloud security: Experience with cloud platforms like AWS, GCP, or Azure is essential for this position.
- SIEM: Hands-on experience with SIEM platforms is necessary for managing large-scale detection.
- EDR: You will utilize EDR tools to enhance incident response capabilities.
- SOAR: Experience with SOAR platforms will aid in automating detection processes.
Who this role suits
- A candidate with over six years of experience in security roles.
- Someone who has a strong understanding of detection languages and cloud security.
- A proactive individual who can work independently and drive projects.
- An effective communicator who can document processes and findings clearly.
From the employer
- Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments.
- Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
- Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
- Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements.
- Participate in investigations, incident response, and postmortems that drive long-term security improvements.
- Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions.
- Participate in a shared on-call rotation for incident response.
- Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting.
- Have built and operated production detections with strong signal quality and sustainable tuning processes.
- Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.
- Have an offensive security mindset and have led purple team, blue team, or adversary emulation exercises that improved detections and telemetry.
- Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection.
- Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments.
- Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently.
- Notion is committed to providing highly competitive cash compensation, equity, and benefits.
- The estimated base salary range for this role is $230,000 - $260,000 per year for roles based in San Francisco or New York City.
Questions about this role
What is the remote policy?
The position is fully remote.
What is the required experience level?
Candidates should have over six years of experience in relevant security fields.
How do I apply for this role?
You can apply through the Notion website.