{"id":1410614,"url":"https://alion.io/job/notion-security-engineer-detection-and-response","title":"Security Engineer, Detection and Response","company":{"id":14288,"name":"Notion","domain":"notion.com","url":"https://alion.io/company/notion","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":81,"open_postings":9,"ghost_share":0,"stale_share":0.556,"repost_share":0,"time_to_fill_p50_days":76,"computed_at":"2026-10-06T05:45:30Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Dublin, Ireland"],"countries":["IE"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":75000,"max":142000,"currency":"EUR","period":"year","gross":null,"usd_annual":161558},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Notion","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SQL","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"Kubernetes","optional":true}],"status":"live","first_seen_at":"2026-09-28T16:17:20Z","employer_posted_date":"2026-09-28","last_verified_at":"2026-10-06T21:46:22Z","board_verified":true,"closed_at":null,"days_open":8,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":8},"description":"Who We Are\nNotion is the collaborative AI workspace where teams and agents think together. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion.\nNotinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work.\nAbout The Role\nMillions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build.\nWe’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion.\nYou’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next.\nWe view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters\nWhat You'll Achieve\nBuild and tune high-signal detections across cloud, identity, endpoint, and SaaS environments, with review and mentorship from senior teammates as you ramp up.\n\nContribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.\n\nBuild tooling and automation that speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.\n\nTurn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements.\n\nTake part in investigations, incident response, and postmortems, and help turn what we learn into lasting fixes.\n\nHelp define and track metrics such as coverage, MTTD, and alert quality.\n\nJoin a shared on-call rotation for incident response.\n\nSkills You'll Need to Bring\nWe're hiring across a range of experience levels. If you have some of these skills but not all, we'd still like to hear from you.\n3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role.\n\nHave written or tuned detections that run in production, and care about signal quality and cutting noise.\n\nWorking knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly.\n\nAn understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect.\n\nHands-on experience with AWS, GCP, or Azure, ideally including identity and access logs.\n\nHave used SIEM, EDR, or SOAR tools in any size of environment.\n\nWrite clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end.\n\nNice to Have\nHave led purple team, blue team, or adversary emulation exercises that improved detections or telemetry.\n\nExperience running SIEM, EDR, or SOAR platforms at large scale.\n\nExperience building or maintaining detection-as-code workflows (version control, CI, and tests for detections).\n\nExperience applying LLMs or agent-style tooling to security workflows.\n\nExperience securing AI-enabled systems or endpoint tooling.\n\nKubernetes or container detection experience.\n\nBackground in threat intelligence, malware analysis, or digital forensics.\n\nContributions to the security community through research, tooling, CTFs, or talks.\n\nExperience at a high-growth startup or AI company.\n\nNotion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role's scope and complexity, and the candidate's experience and expertise, and may vary from the range provided below. The estimated base salary range for this role is €75,000-€142,000 per year.\nBy clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy.\nA Note on AI\nYou don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement - when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on.\nEqual Opportunity & Accommodations\nWe hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know.\nNotion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.","description_format":"text","description_chars":6569,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"Ireland","iso":"IE","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Office & Productivity Software","Project & Work Management Software","Intranet & Knowledge Management"],"lifecycle":[{"event":"open","at":"2026-09-28T19:10:57Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":7,"expected_fill_days":76,"reasons":["conf:0","velocity","win:early","comp:brand"],"computed_at":"2026-10-06T05:45:30Z"},"pay":{"stated_usd_annual":161558,"is_top_pay":true},"html_url":"https://alion.io/job/notion-security-engineer-detection-and-response","json_url":"https://alion.io/job/notion-security-engineer-detection-and-response.json","meta":{"generated_at":"2026-10-06T23:22:46Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":4732,"day_limit":5000,"remaining_today":268,"minute_limit":60,"resets_at":"2026-10-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":14288},"rest":"https://alion.io/mcp/rest/get_company?id=14288"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnotion-security-engineer-detection-and-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnotion-security-engineer-detection-and-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnotion-security-engineer-detection-and-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/notion-security-engineer-detection-and-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnotion-security-engineer-detection-and-response"}]}