Notion

Security Engineer, Detection and Response, San Francisco

San Francisco, California

Sponsorship not specified$230k-$260kDetected 42 days ago

AWSGCPAzureKubernetesLLMsAgentic AICybersecuritySIEMKQLSOARSOC OperationsDetection EngineeringIncident ResponseResearch

About the role

You'll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion.
We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters
Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions.

Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build.
You'll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what's needed next.
Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
Participate in investigations, incident response, and postmortems that drive long-term security improvements.
Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently.

Experience applying LLMs or agent-style tooling to security workflows.
Experience securing AI-enabled systems or endpoint tooling.
Kubernetes or container detection experience.
Background in threat intelligence, malware analysis, or digital forensics.
Contributions to the detection engineering community through research, tooling, or talks.
Experience at a high-growth startup or AI company
You don't need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work.
For some roles, AI fluency is a core requirement - when that's the case, we'll say so explicitly in the qualifications.

Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting.
Have built and operated production detections with strong signal quality and sustainable tuning processes.
Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.
Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection.
Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments.
Notion is the collaborative AI workspace where teams and agents think together https://www.youtube.com/watch?v=vkpYpWfEK5s.
Millions of individuals, small teams, and large companies run their work on Notion.
Notinos (our employees) are customer zero in bringing this future of work to life.
Our goal isn't to ship the next feature.

Notion is committed to providing highly competitive cash compensation, equity, and benefits.

Notion is the collaborative AI workspace where teams and agents think together https://www.youtube.com/watch?v=vkpYpWfEK5s. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion.
Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn't to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business's system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life's work.
We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented.
We care about craft, building things that last, and the belief that great work is still fundamentally human.
Each and every team of Notinos is working to set the standard for how humans work together in the AI era.
From building a business's system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life's work.

This listing is sourced directly from Notion's careers page and normalized into a canonical job model.