安全工程师，检测与响应，都柏林
Security Engineer, Detection and Response, Dublin
我们是谁
Notion 是一个协作型 AI 工作空间，团队和代理可以一起思考 https://www.youtube.com/watch?v=vkpYpWfEK5s。我们正在打造一个地方，让您的知识、项目、会议和 AI 工具并存，使工作更快、更清晰、更不零散。数百万个人、小团队和大公司都在 Notion 上开展工作。
Notinos（我们的员工）是将这种未来的工作方式变为现实的客户零。我们关注工艺，打造持久的事物，并相信优秀的工作本质上是人性化的。我们的目标不是推出下一个功能。每一位 Notinos 团队都在努力设定人类在 AI 时代协作的标准。从构建企业的记录系统到创建和管理 AI 代理，再到自动化处理琐碎的工作，我们非常重视为客户节省时间，让他们专注于人生的重要工作。
职位简介
数百万人依赖 Notion 完成他们最重要的工作，保护这份信任是我们一切工作的基础。
我们正在寻找一位动手能力强的检测工程师，负责构建和运营我们在 Notion 云原生环境中用于检测和响应攻击的系统和流程。您将发布高信号检测，改进支撑这些检测的平台，参与事件响应，并帮助塑造 Notion 检测和响应工程的扩展方式。
您将与工程、企业安全和基础设施团队密切合作，有广泛的自主权来识别差距、优先投资并构建下一步所需的内容。
我们视检测和响应为软件工程领域：检测是代码，平台是产品，度量很重要
您将实现的目标
- 在云、身份、终端和 SaaS 环境中设计和维护高信号检测。
- 构建和改进检测平台，包括规则生命周期管理、调优、度量和部署安全性。
- 开发加速分类、丰富、调查和检测编写的工具和自动化，包括在有用时基于 LLM 的工作流。
- 将威胁情报和对手 TTP 转化为持久的检测、遥测需求和响应改进。
- 参与调查、事件响应和事后分析，推动长期的安全改进。
- 定义并跟踪关键指标，如覆盖率、MTTD 和警报质量，以指导投资决策。
- 参与一个 s
查看英文原文
WHO WE ARE
Notion is the collaborative AI workspace where teams and agents think together https://www.youtube.com/watch?v=vkpYpWfEK5s. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion.
Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work.
ABOUT THE ROLE
Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build.
We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion.
You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next.
We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters
WHAT YOU'LL ACHIEVE
- Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments.
- Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
- Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
- Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements.
- Participate in investigations, incident response, and postmortems that drive long-term security improvements.
- Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions.
- Participate in a shared on-call rotation for incident response.
SKILLS YOU'LL NEED TO BRING
- Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting.
- Have built and operated production detections with strong signal quality and sustainable tuning processes.
- Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.
- Have an offensive security mindset and have led purple team, blue team, or adversary emulation exercises that improved detections and telemetry.
- Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection.
- Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments.
- Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently.
NICE TO HAVE
- Experience applying LLMs or agent-style tooling to security workflows.
- Experience securing AI-enabled systems or endpoint tooling.
- Kubernetes or container detection experience.
- Background in threat intelligence, malware analysis, or digital forensics.
- Contributions to the detection engineering community through research, tooling, or talks.
- Experience at a high-growth startup or AI company.
Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role's scope and complexity, and the candidate's experience and expertise, and may vary from the range provided below. The estimated base salary range for this role is €127,000–€142,000 per year.
By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy https://notion.notion.site/Notion-Global-Recruiting-Privacy-Policy-fc3eb4e829354a26a2bb6fd5e289b550?pvs=74.
#LI-Onsite
A NOTE ON AI
You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on.
EQUAL OPPORTUNITY & ACCOMMODATIONS
We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know.
Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.