Security Engineer, Detection and Response
San Francisco · New York · USD 185,000-280,000 / year · 3+ years experience · Full-time · Hybrid · Posted Sep 28, 2026
At a glance
- Experience
- 3+ years experience
- Employment
- Full-time
- Workplace
- Hybrid
- Location
- San Francisco · New York
- Salary
- USD 185,000-280,000 / year · Base salary
About the role
- Notion is seeking a hands-on Detection Engineer to build and operate systems and workflows for detecting and responding to attacks across their cloud-native environment.
- The role involves shipping high-signal detections, improving detection platforms, participating in incident response, and scaling detection and response engineering.
Responsibilities
- Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments.
- Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
- Build tooling and automation to speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows.
- Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements.
- Participate in investigations, incident response, and postmortems to implement lasting fixes.
- Define and track metrics such as coverage, MTTD, and alert quality.
- Join a shared on-call rotation for incident response.
Requirements
- 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role.
- Experience writing or tuning detections that run in production.
- Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills.
- Understanding of how attackers operate (e.g., MITRE ATT&CK).
- Hands-on experience with AWS, GCP, or Azure, including identity and access logs.
- Experience using SIEM, EDR, or SOAR tools.
- Ability to write clearly in runbooks, design docs, and incident notes.
Preferred qualifications
- Led purple team, blue team, or adversary emulation exercises.
- Experience running SIEM, EDR, or SOAR platforms at large scale.
- Experience building or maintaining detection-as-code workflows.
- Experience applying LLMs or agent-style tooling to security workflows.
- Experience securing AI-enabled systems or endpoint tooling.
- Kubernetes or container detection experience.
- Background in threat intelligence, malware analysis, or digital forensics.
- Contributions to the security community through research, tooling, CTFs, or talks.
Benefits
- Competitive cash compensation
- Equity
Workplace
- Role is onsite in San Francisco or New York.
Skills
- AWS
- GCP
- Azure
- Sigma
- KQL
- SPL
- YARA-L
- EQL
- Panther
- SQL
- Python
- SIEM
Show all 15 skills
- EDR
- SOAR
- MITRE ATT&CK
