Security Engineer, Detection and Response

Join Notion as a Security Engineer to build and operate systems for detecting and responding to attacks in a cloud-native environment. Work closely with teams to enhance security measures and protect user trust. Notion is the collaborative AI workspace where teams and agents think together. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion.

• •Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments.
• •Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
• •Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
• •Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements.
• •Participate in investigations, incident response, and postmortems that drive long-term security improvements.
• •Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions.
• •Participate in a shared on-call rotation for incident response.

• •Notion is committed to providing highly competitive cash compensation, equity, and benefits.
• •The estimated base salary range for this role is $230,000 - $260,000 per year for roles based in San Francisco or New York City.