16 days ago
San Francisco, CA, USA or New York, NY, USAMid Level
H1B sponsor
Base Salary
$185k - $280k/yr
Responsibilities
- Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments.
- Contribute to detection-platform rule lifecycle management, tuning, measurement, and rollout safety.
- Build tooling and automation for triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
- Translate threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements.
- Participate in investigations, incident response, postmortems, and a shared incident-response on-call rotation.
- Define and track detection metrics including coverage, MTTD, and alert quality.
Requirements
- At least 3 years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role.
- Production experience writing or tuning detections with an emphasis on signal quality and noise reduction.
- Working knowledge of at least one detection or query language, such as Sigma, KQL, SPL, YARA-L, EQL, or Panther, or strong SQL or Python skills with willingness to learn quickly.
- Understanding of attacker behavior, such as MITRE ATT&CK, and the ability to use it to determine detection priorities.
- Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs.
- Experience using SIEM, EDR, or SOAR tools.
- Ability to write runbooks, design documents, and incident notes and own well-scoped projects end to end.
- Preferred qualifications include purple-team, blue-team, or adversary-emulation leadership; large-scale SIEM, EDR, or SOAR platform experience; detection-as-code workflows; LLM or agent-style security tooling; AI-enabled systems or endpoint security; Kubernetes or container detection; threat intelligence, malware analysis, or digital forensics; and security-community contributions.
Benefits
- Competitive cash compensation, equity, and benefits are offered.
- For roles based in San Francisco or New York City, the estimated base salary range is $185,000-$280,000 per year.
- The role includes shared incident-response on-call coverage.
- Notion provides reasonable accommodations during the application process.
Categories
About Notion
Notion builds an all-in-one workspace that combines docs, wikis, databases, and project management with collaborative AI features for individuals and teams. It operates a freemium, subscription-based, land‑and‑expand model used from small groups to large enterprises. Founded in 2016 and headquartered in San Francisco, the privately held company focuses on unifying knowledge, projects, and workflows in a customizable platform.