Security Operations Engineer, Detection and Response Team at Notion

Notion is seeking a Security Operations Engineer to join their Detection and Response Team. The ideal candidate will improve and optimize Notion's security monitoring program. This role requires strong communication and analytical skills, technical ability, and attention to detail. The engineer will proactively monitor emerging threats and vulnerabilities, and design creative approaches to effective security monitoring at scale.

What this role involves:

• Designing and implementing advanced detections.
• Automating security workflows.
• Leading incident investigations.
• Conducting proactive threat hunts.
• Evolving security defenses.
• Reducing dwell time.
• Responding to sophisticated adversaries.

Requirements:

• 5+ years of experience in security detection, response, operations, or related fields.
• Strong ability to write, tune, and optimize detections across various platforms (e.g., EDR, SIEM, network monitoring).
• Proficiency in scripting and automation (Python, Go, or similar).
• Experience with detection rule development (Sigma, YARA, Splunk SPL, KQL).
• Deep expertise in the incident response lifecycle.
• Experience securing cloud-native environments (AWS, GCP, or Azure).
• Practical knowledge of detecting malicious activity in application and infrastructure architectures in a SaaS environment.

What Notion Offers:

• Opportunity to work on high-impact security efforts.
• Collaborative team environment.
• Mentorship, learning, and continuous improvement opportunities.