Security Engineer, Detection and Response

About the Company

Purpose Bits is affiliated with Notion, an innovative collaborative AI platform designed to integrate knowledge management, projects, meetings, and AI tools into a seamless workspace. Millions of users including individuals, small groups, and enterprises rely on Notion's platform for efficient and unified work experiences. The team, known as Notinos, deeply values craftsmanship, enduring solutions, and advancing human collaboration in the AI era.

Role Overview

Notion seeks a proactive Detection Engineer focused on building and managing systems that detect and respond to security threats within its cloud-native infrastructure. The role involves developing high-quality detection signals, enhancing the detection platform, engaging in incident response, and scaling detection engineering efforts across the company. Collaboration with Engineering, Corporate Security, and Infrastructure teams is key, combined with autonomy to identify vulnerabilities, prioritize developments, and innovate necessary solutions. The approach treats detection and response as software engineering disciplines emphasizing code quality, product orientation, and metrics-driven outcomes.

Key Responsibilities

• Create and sustain precise detection mechanisms covering cloud environments, identity systems, endpoints, and SaaS platforms.
• Develop the detection platform encompassing lifecycle management of detection rules, tuning processes, performance measurement, and safe deployment strategies.
• Design tools and automate workflows to expedite triage, enrichment, investigation, and authoring of detections; incorporate large language model (LLM)-based methods where applicable.
• Convert threat intelligence and attacker tactics, techniques, and procedures (TTPs) into durable detection strategies, telemetry enhancements, and response refinements.
• Take part in investigations, incident handling, and post-incident analyses to foster ongoing security enhancements.
• Establish and monitor critical metrics such as detection coverage, mean time to detect (MTTD), and alert accuracy to inform investment priorities.
• Contribute to a shared on-call schedule supporting incident response activities.

Required Qualifications

• A minimum of six years’ experience in roles related to detection engineering, security operations, incident response, or threat hunting.
• Proven experience designing and managing high-fidelity production detections with effective tuning methodologies.
• Proficiency in detection languages such as Sigma, Kusto Query Language (KQL), Splunk Processing Language (SPL), YARA-L, Event Query Language (EQL), or Panther.
• A strong offensive security perspective with leadership experience in purple team activities, blue team defense, or adversary emulation to enhance detection and telemetry.
• Expertise in cloud security across platforms like AWS, Google Cloud Platform (GCP), or Azure, especially related to identity-focused attack detection.
• Hands-on experience with SIEM, EDR, and SOAR tools designed for large-scale environments.
• Ability to produce clear documentation including design documents, runbooks, and incident reports, and to drive projects independently.

Desirable Skills

• Applying large language models or agent-based tools to streamline security operations.
• Experience securing AI-driven systems or endpoint technologies.
• Knowledge of Kubernetes or container security detection.
• Background in threat intelligence, malware analysis, digital forensics or related fields.
• Contributions to the detection engineering field through research, tooling development, or speaking engagements.
• Prior experience in fast-paced startups or artificial intelligence companies.

Compensation and Policies

Notion offers a competitive salary package that includes cash compensation, equity options, and benefits. The approximate salary range for this position is €127,000 to €142,000 annually, with actual offers tailored based on location, role complexity, and candidate qualifications.

Diversity and Inclusion Statement

Notion embraces equal opportunity employment and encourages applications from diverse backgrounds. The company does not discriminate based on legally protected criteria and provides reasonable accommodations throughout the hiring process. They consider candidates with arrest or conviction histories in accordance with applicable law and support individuals with disabilities to apply and participate fully.

Notion's Philosophy on AI

While not all roles require deep AI knowledge, all employees are expected to be curious, experimental, and embrace AI as a collaborator to enhance their work. AI fluency is explicitly required for some positions, but overall, Notion values leveraging AI to improve thinking and efficiency rather than treating it as a novelty.