N
$185,000 – $280,000
Listed on Notion’s own careers site. You apply with them directly — we never stand between you and the employer.
What this role is
Notion seeks a detection engineer to build production detection systems and respond to security incidents across their cloud infrastructure. This role combines software engineering rigor with security operations, suited for someone who enjoys writing detections as code and improving how threats are caught at scale.
Our summary, not Notion’s wording. The full posting is on their site.
Skills this role names
Log in to see which of these are already on your profile.
What they ask for
Required
- 3+ years in detection engineering, security operations, incident response, threat hunting, or related security/software engineering role
- Written or tuned detections in production with focus on signal quality
- Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, Panther) or strong SQL/Python skills
- Understanding of attacker tactics and MITRE ATT&CK framework
- Hands-on experience with AWS, GCP, or Azure including identity and access logs
- Experience with SIEM, EDR, or SOAR tools
- Clear writing in runbooks, design docs, and incident notes; ability to own scoped projects end to end
Nice to have
- Led purple team, blue team, or adversary emulation exercises
- Operated SIEM, EDR, or SOAR platforms at large scale
- Built or maintained detection-as-code workflows with version control and CI/CD
- Applied LLMs or agent-style tooling to security workflows
- Experience securing AI-enabled systems or endpoint tooling
- Kubernetes or container detection experience
- Background in threat intelligence, malware analysis, or digital forensics
- Security community contributions through research, tooling, CTFs, or talks
- Experience at high-growth startup or AI company