Detection Engineer (AI)

Location: Hybrid in San Francisco, California or New York, New York

Base salary: $185,000–$280,000 per year for roles based in San Francisco or New York City, plus equity and benefits.

Company

Notion is a collaborative AI workspace that brings knowledge, projects, meetings, and AI tools together for individuals, teams, and companies.

What you will do

• Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments.
• Contribute to the detection platform through rule lifecycle management, tuning, measurement, and safe rollout.
• Develop tooling and automation for triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
• Translate threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements.
• Participate in investigations, incident response, postmortems, and a shared on-call rotation.
• Define and track detection metrics such as coverage, MTTD, and alert quality.

Requirements

• 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a related security or software engineering role.
• Production experience writing or tuning detections with a focus on signal quality and reducing noise.
• Working knowledge of Sigma, KQL, SPL, YARA-L, EQL, Panther, SQL, or Python, with the ability to learn detection languages quickly.
• Understanding of attacker behavior and MITRE ATT&CK, with the ability to use it to determine detection priorities.
• Hands-on experience with AWS, GCP, or Azure, preferably including identity and access logs.
• Experience with SIEM, EDR, or SOAR tools, plus clear technical writing and ownership of projects from start to finish.

Nice to have

• Experience leading purple team, blue team, or adversary emulation exercises.
• Experience operating SIEM, EDR, or SOAR platforms at large scale and maintaining detection-as-code workflows with version control, CI, and tests.
• Experience applying LLMs or agent-style tooling to security workflows or securing AI-enabled systems.
• Kubernetes or container detection experience, or a background in threat intelligence, malware analysis, or digital forensics.
• Security community contributions through research, tooling, CTFs, or talks, or experience at a high-growth startup or AI company.

Culture & Benefits

• Work in a collaborative AI workspace company focused on building durable products and protecting customer trust.
• Partner closely with Engineering, Corporate Security, and Infrastructure teams with broad latitude to identify gaps and prioritize investments.
• Competitive cash compensation, equity, and benefits.
• Detection and response are treated as a software engineering discipline, with emphasis on code quality, platform development, and measurement.