This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
Notion is looking for a talented Security Engineer with solid communication and analytical skills to help us improve and optimize our security monitoring program. We are seeking someone with a mixture of technical ability, attention to detail, and who can function comfortably in a variety of cyber security disciplines. In addition to technical acumen and enthusiasm, we need a self-motivator to stay on top of emerging threats and vulnerabilities to Notion; providing a continuous proactive monitoring approach.
Job Responsibility:
Design and implement advanced detections, automate security workflows, lead incident investigations, and conduct proactive threat hunts to identify and mitigate risks before they impact Notion
Lead detection engineering efforts, designing scalable, high-fidelity security detections across cloud, endpoint, and application environments
Develop automation & orchestration solutions to improve response and containment times and enhance security workflows
Own and drive incident response and command, leading major security incidents, containment, and remediation efforts
Conduct proactive threat hunting, leveraging threat intelligence and hypothesis-driven methodologies to detect hidden adversary activity
Reverse-engineer attacks, analyzing adversary behavior and developing robust detection strategies
Continuously improve security defenses, applying lessons learned from incidents, hunting exercises, and emerging threat trends
Requirements:
5+ years of experience in security detection, response, or related fields
Strong ability to write, tune, and optimize detections across various platforms (e.g., EDR, SIEM, network monitoring)
Proficiency in scripting and automation (Python, Go, or similar) to enhance detection and response capabilities
Experience with detection rule development (Sigma, YARA, Splunk SPL, KQL) and security event correlation
Deep expertise in the incident response lifecycle, including investigation, containment, remediation, and recovery
Lead security incidents and command response efforts, ensuring rapid containment and mitigation—even in unfamiliar environments and across team boundaries
Lead post-incident learning, conducting blameless postmortems and driving follow-up actions that address systemic issues and prevent recurrence
Experience securing cloud-native environments (AWS, GCP, or Azure), including detection and response strategies for cloud workloads
Practical knowledge of detecting malicious activity in application and infrastructure architectures in a SaaS environment
Ability to assess security gaps and propose detection & response improvements across cloud and endpoint platforms
Pragmatic and business-oriented: You focus on high-impact security efforts, balancing security investments with real-world risk
Not ideological about technology: You see technologies and programming languages as tools with tradeoffs—you’re opinionated but adaptable, always willing to learn new technologies
Empathetic communication: You clearly articulate complex security issues, whether in technical discussions or executive briefings. You engage thoughtfully in disagreements and find common ground when needed
Team player: You thrive in a team environment, collaborating cross-functionally to accomplish shared security goals. You care about mentorship, learning, and continuous improvement
Nice to have:
Experience leading large-scale security initiatives or driving security automation programs
Background in red teaming, adversary emulation, or offensive security
Familiarity with application-level detections, such as database security monitoring, detecting malicious queries, or abnormal application behavior
Familiarity with security compliance standards (SOC 2, ISO 27001), though not a primary focus
Involvement in the security community, such as conference presentations or open-source contributions