Security Engineer, Detection and Response

Dublin · EUR 75,000-142,000 / year · 3+ years experience · Full-time · Hybrid · Posted Sep 28, 2026

At a glance

Notion is seeking a hands-on Detection Engineer to build and operate systems and workflows for detecting and responding to attacks within their cloud-native environment.
The role involves shipping high-signal detections, improving detection platforms, participating in incident response, and scaling detection engineering practices.
The position requires close collaboration with Engineering, Corporate Security, and Infrastructure teams to identify gaps and prioritize security investments.

Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments.
Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
Build tooling and automation to speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows.
Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements.
Participate in investigations, incident response, and postmortems to implement lasting fixes.
Define and track metrics such as coverage, MTTD, and alert quality.
Join a shared on-call rotation for incident response.

3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a related security/software engineering role.
Experience writing or tuning detections that run in production.
Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills.
Understanding of attacker operations, such as MITRE ATT&CK.
Hands-on experience with AWS, GCP, or Azure, including identity and access logs.
Experience using SIEM, EDR, or SOAR tools.
Ability to write clearly in runbooks, design docs, and incident notes.
Ability to own well-scoped projects end to end.

Led purple team, blue team, or adversary emulation exercises.
Experience running SIEM, EDR, or SOAR platforms at large scale.
Experience building or maintaining detection-as-code workflows.
Experience applying LLMs or agent-style tooling to security workflows.
Experience securing AI-enabled systems or endpoint tooling.
Kubernetes or container detection experience.
Background in threat intelligence, malware analysis, or digital forensics.
Contributions to the security community through research, tooling, CTFs, or talks.

Show all 15 skills