WHO WE ARE

Notion is the collaborative AI workspace where teams and agents think together. We're building one place where your knowledge,

projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals,

small teams, and large companies run their work on Notion.

Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last,

and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of

Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to

making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their

life’s work.

ABOUT THE ROLE

Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we

build.

We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to

attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them,

participate in incident response, and help shape how detection and response engineering scales at Notion.

You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize

investments, and build what’s needed next.

We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement

matters

WHAT YOU'LL ACHIEVE

Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments.

Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.

Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based

workflows where useful.

Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements.

Participate in investigations, incident response, and postmortems that drive long-term security improvements.

Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions.

Participate in a shared on-call rotation for incident response.

SKILLS YOU'LL NEED TO BRING

Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting.

Have built and operated production detections with strong signal quality and sustainable tuning processes.

Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther.

Have an offensive security mindset and have led purple team, blue team, or adversary emulation exercises that improved

detections and telemetry.

Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection.

Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments.

Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently.

NICE TO HAVE

Experience applying LLMs or agent-style tooling to security workflows.

Experience securing AI-enabled systems or endpoint tooling.

Kubernetes or container detection experience.

Background in threat intelligence, malware analysis, or digital forensics.

Contributions to the detection engineering community through research, tooling, or talks.

Experience at a high-growth startup or AI company.

Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this

role will be based on multiple factors such as location, the role's scope and complexity, and the candidate's experience and

expertise, and may vary from the range provided below. The estimated base salary range for this role is €127,000–€142,000 per

year.

By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process

my information in accordance with Notion’s Global Recruiting Privacy Policy.

#LI-Onsite

A NOTE ON AI

You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering

and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when

that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to

think better, and make their work easier for others to build on.

EQUAL OPPORTUNITY & ACCOMMODATIONS

We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still

encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected

characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction

records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter

know.

Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race,

color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status,

ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation,

or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent

with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified

individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation

due to a disability, please let your recruiter know.

Role

Security Engineer, Detection and Response

Locations

Dublin

Published

January 29

Deadline

August 16

Tags for this job

AWS Azure GCP Kubernetes AI Rust

Similar Jobs

Security Engineer - Incident Response

Squarespace

Dublin•Posted: Jul 6•Deadline: Aug 16

Squarespace is looking for a Security Engineer with a focus on Investigations and Incident Response to join a dedicated team responsible for monitoring and responding to attacks on our platform. You'll partner with teams across the organization as you investigate security events specific to our platform and corporate environment. This is a hybrid role working from our Dublin office 3 days per week and you will report to the Detection and Response Manager. YOU’LL GET TO… * You will investigate security events through our SIEM and SOAR technology * Design alerts to monitor both our customer and corporate environments for anomalous behavior * Share insights gleaned from SOAR case work with relevant security team members in order to drive more security feature implementation to the product or corporate environment * You will respond to ongoing incidents, investigate historical compromises, and provide adept analysis and findings * Establish strategies for threat detection, alerting, and response * You will initiate reactive threat hunting engagements by performing endpoint, network, application, and log analysis * Establish processes and build 'playbooks' of operational response to security events and/or incidents * Familiarity with Threat Intelligence and keeping up-to-date on modern threats and InfoSec news * Build and support security-focused tools and services * Provide Mentorship and technical expertise to junior team members to assist their technical development WHO WE’RE LOOKING FOR * 5+ years experience in the security industry * Certifications (preferred not required): OSCP, OSCE, OSWP * Experience working with SIEM and SOAR technologies * Knowledgeable of cloud & container security, and infrastructure as code * Working understanding of malware analysis, reverse engineering, and host-based and memory forensics * Proficiency in programming or scripting languages (preference to Python, Go, JavaScript, or Bash) is a plus * Knowledge of network and web related protocols (e.g., TCP/IP, UDP, IPSEC, HTTP/HTTPS) and how to keep them secure * Familiarity with red & purple team exercises, adversary resilience, and cyber deception * Experience working with cloud technologies (eg. Amazon Web Services, Google Cloud Platform, etc.) and Networking and Web Application security BENEFITS & PERKS * Health insurance with 100% covered premiums for you, your spouse or partner and your dependent children including medical, dental, and vision * Life and Income Protection * Fertility and adoption benefits * Headspace mindfulness app subscription * Global Employee Assistance Program * Pension benefits with employer match * Flexible paid time off * 26 weeks paid maternity leave & 12 weeks paid paternity leave * 2 weeks paid family care leave * Annual Tax-Free Stipend * Education reimbursement * Employee donation match to community organizations * 7 Global Employee Resource Groups (ERGs) * Free lunch and snacks * Close proximity to cultural landmarks such as Dublin Castle and St. Patrick's Cathedral CASH COMPENSATION RANGE: €70,000 - €107,800 EUR The base salary for this position will vary based on job-related criteria including relevant skills, experience, and location, among other factors. In addition to the cash compensation above (which includes base salary and, where applicable for eligible roles, may include overtime pay), Squarespace employees are eligible to be granted an option to purchase our common stock. ABOUT SQUARESPACE Squarespace is a design-driven platform helping entrepreneurs build brands and businesses online. We empower millions of customers in more than 200 countries and territories with all the tools they need to create an online presence, build an audience, monetize, and scale their business. Our suite of products range from websites, domains, ecommerce, and marketing tools, as well as tools for scheduling with Acuity and creating and managing social media presence with Bio Sites and Unfold. Our team of more than 1,700 is headquartered in New York City, with offices in Dublin, Ireland, and Aveiro, Portugal. For more information about our company, visit https://www.squarespace.com/about/careers. OUR COMMITMENT Today, more than a million people around the globe use Squarespace to share different perspectives and experiences with the world. Not only do we embrace and celebrate the diversity of our customer base, but we also strive for the same in our employees. At Squarespace, we are committed to equal employment opportunity regardless of race, color, ethnicity, ancestry, religion, national origin, gender, sex, gender identity or expression, sexual orientation, age, citizenship, marital or parental status, disability, veteran status, or other class protected by applicable law. We are proud to be an equal opportunity workplace. Thank you in advance for providing the following details about your work history from your resume! This helps us ensure that your candidate information is accurate and consistent during the hiring process. Squarespace will never solicit your personal banking information or ask you to transfer money in connection with a job offer or interview. We also will not reach out to you via phone or SMS without your permission or knowledge. If you plan to use AI in any capacity during your candidate journey, please review our Candidate AI Policy.

Senior Security Engineer - Cloud SIEM

Datadog

Dublin•Posted: Jun 11•Deadline: Aug 16

As a Senior Security Engineer focused on Datadog’s Cloud SIEM product, you will help shape the future of security operations by transforming real-world security expertise into scalable detection, investigation, and response capabilities. You will develop high-impact threat detection content, improve AI-assisted security workflows, and help defenders identify and respond to threats across cloud-native and enterprise environments. Working closely with Product, Engineering, and Security Research teams, you will influence the evolution of Datadog Security products while advancing detection coverage across emerging technologies and attack surfaces. This role offers the opportunity to contribute to open source initiatives, publish security research, and help define the next generation of agentic security operations capabilities. At Datadog, we place value in our office culture - the relationships and collaboration it builds and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You'll Do: * Research attacker techniques, defensive strategies, and emerging threats, translating findings into scalable security capabilities that protect customers at cloud scale. * Design and improve AI-powered investigation, threat hunting, and response workflows that support Datadog’s agentic SOC capabilities. * Own the lifecycle of threat detections and automated security workflows, from research and design through deployment, measurement, and continuous improvement. * Develop high-fidelity detection content across cloud platforms, SaaS applications, identity systems, endpoints, networks, and other modern attack surfaces. * Partner with Product, Engineering, Security Research, and customers to influence roadmap decisions and improve security outcomes across the platform. * Mentor security engineers and drive improvements through automation, tooling, rapid prototyping, and data-driven optimization. Who You Are: * Experienced in detection engineering, incident response, threat hunting, security operations, or related defensive security disciplines. * Knowledgeable in securing and operating public cloud environments such as AWS, Azure, or GCP, along with cloud-native technologies including Kubernetes, Docker, and Terraform. * Skilled in modern detection engineering practices, including detection-as-code methodologies and large-scale security telemetry analysis. * Proficient in Python, Go, or similar programming languages used to automate workflows, analyze security data, and build security tooling. * Comfortable driving initiatives through ambiguity while collaborating effectively across engineering, product, and research organizations. * Passionate about applying AI and automation to improve how defenders investigate, detect, and respond to threats. Datadog values people from all walks of life. We know not everyone will meet all the above qualifications on day one. That’s okay. If you’re passionate about technology and want to grow your experience, we encourage you to apply. Benefits and Growth: * New hire stock equity (RSUs) and employee stock purchase plan (ESPP). * Continuous professional development, product training, and career growth opportunities. * Mentor and buddy programs that support learning, development, and internal networking. * An inclusive culture with opportunities to participate in Community Guilds and employee resource groups. * Access to Inclusion Talks and other learning experiences that foster belonging and growth. * Comprehensive mental health benefits for employees and eligible dependents. * Competitive benefits programs that support employees globally. Benefits and Growth listed above may vary based on the country of your employment and the nature of your employment with Datadog. #LI-Hybrid ---------------------------------------------------------------------------------------------------------------------------------- About Datadog: Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale. It brings applications, infrastructure, data, models, and security into one place, using AI to detect and resolve issues before they impact customers. Trusted globally by Fortune 500 companies and high-growth AI leaders, Datadog enables businesses to move faster with clarity and confidence. Learn more about #DatadogLife on Instagram, LinkedIn, and Datadog Learning Center. ---------------------------------------------------------------------------------------------------------------------------------- Equal Opportunity at Datadog: Datadog is proud to offer equal employment opportunity to everyone regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity, veteran status, and other characteristics protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. Here are our Candidate Legal Notices for your reference. Datadog endeavors to make our Careers Page accessible to all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please complete this form. This form is for accommodation requests only and cannot be used to inquire about the status of applications. Privacy and AI Guidelines: Any information you submit to Datadog as part of your application will be processed in accordance with Datadog’s Applicant and Candidate Privacy Notice. For information on our AI policy, please visit Interviewing at Datadog AI Guidelines.

Security

Security Incident Response Manager

Stripe

Dublin•Posted: Jun 26•Deadline: Aug 16

WHO WE ARE ABOUT STRIPE Stripe is a financial infrastructure platform for businesses. Millions of companies - from the world’s largest enterprises to the most ambitious startups - use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career. ABOUT THE TEAM The Security Incident Response team is responsible for triaging and assessing the severity of incoming security alerts, responding with initial containment measures and escalating as needed to incident responders for further investigation and resolution. They analyze a variety of data sources to identify potential threats, collect requirements for operational enhancements to detection and response systems, and generally scale security processes. From external attacks to insider threats, our goal is to respond with speed and precision, remediate, and support the incident postmortem process. The team is distributed globally and regularly coordinates with stakeholders in North America, Europe, and Asia. WHAT YOU’LL DO You will leverage your security management experience to improve incident response capabilities at Stripe. You will manage a team of security analysts, investigators, and responders on the front lines of the incident response process, hiring, training, and evaluating their performance, providing technical guidance where needed, developing clear and consistent response procedures, and ensuring timely and effective resolution of casework. You will also collaborate with various internal stakeholders, including the Security Analytics and Detection teams, and make continuous improvements to Stripe’s security incident response function. RESPONSIBILITIES * Lead and support a team of security analysts, investigators, and responders who triage, assess, and respond to threats * Provide technical guidance to the team, as a subject matter expert * Influence the organizational mission and vision by ensuring prioritization and delivery of project work that is aligned with relevant security roadmaps * Strengthen KPIs and metrics for measuring response operations effectiveness, for clear and consistent reporting to internal stakeholders * Work cross-functionally with security engineering teams to gather requirements for analyzing and responding to security events data at scale while protecting Stripe networks, systems, and data from threats * Develop, document, and implement strategies, runbooks, and capabilities to support the incident response process * Continuously improve security processes and response capabilities by collaborating with security engineers and analysts * Coach and mentor individual contributors, enabling career development and championing quality standards within the team WHO YOU ARE We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement. MINIMUM REQUIREMENTS * 5+ years experience leading Security Operations or Incident Response teams, including hands-on, technical management experience of security analysts or engineers * B.S. or M.S. Computer Science or related field, or equivalent experience in Security * Experience recruiting, growing, and leading technical teams, including performance management * Excellent written and verbal communication skills, including the ability to develop and deliver operational or incident-related information to leadership * Advanced knowledge of data analytics (e.g. logs for first or third party applications, system / data access events), network security, digital forensics, and incident response investigations * Experience with Python and SQL, and/or familiarity with other programming languages * Familiarity with operating systems, file systems, and memory on macOS, Linux, or Windows * Strong understanding of threat actor tactics, techniques, and procedures (TTPs) PREFERRED QUALIFICATIONS * Broad knowledge and experience across the information security domain, including familiarity with endpoint, email, network, identity management, cloud security, vulnerability management, incident response, and threat intelligence. * Experience with engineering, data processing and analysis tools * Familiarity with network observability, security software, or data engineering solutions (Chronicle, Tines, osquery, Splunk, etc.)

8611 Security Analytics