Security Engineer - Purple Team specialist H/F

Squarespace

Squarespace is looking for a Security Engineer with a focus on Investigations and Incident Response to join a dedicated team responsible for monitoring and responding to attacks on our platform. You'll partner with teams across the organization as you investigate security events specific to our platform and corporate environment.  This is a hybrid role working from our Dublin office 3 days per week and you will report to the Detection and Response Manager. YOU’LL GET TO… * You will investigate security events through our SIEM and SOAR technology * Design alerts to monitor both our customer and corporate environments for anomalous behavior * Share insights gleaned from SOAR case work with relevant security team members in order to drive more security feature implementation to the product or corporate environment * You will respond to ongoing incidents, investigate historical compromises, and provide adept analysis and findings * Establish strategies for threat detection, alerting, and response * You will initiate reactive threat hunting engagements by performing endpoint, network, application, and log analysis * Establish processes and build 'playbooks' of operational response to security events and/or incidents * Familiarity with Threat Intelligence and keeping up-to-date on modern threats and InfoSec news * Build and support security-focused tools and services * Provide Mentorship and technical expertise to junior team members to assist their technical development WHO WE’RE LOOKING FOR  * 5+ years experience in the security industry * Certifications (preferred not required): OSCP, OSCE, OSWP * Experience working with SIEM and SOAR technologies * Knowledgeable of cloud & container security, and infrastructure as code * Working understanding of malware analysis, reverse engineering, and host-based and memory forensics * Proficiency in programming or scripting languages (preference to Python, Go, JavaScript, or Bash) is a plus * Knowledge of network and web related protocols (e.g., TCP/IP, UDP, IPSEC, HTTP/HTTPS) and how to keep them secure * Familiarity with red & purple team exercises, adversary resilience, and cyber deception * Experience working with cloud technologies (eg. Amazon Web Services, Google Cloud Platform, etc.) and Networking and Web Application security BENEFITS & PERKS * Health insurance with 100% covered premiums for you, your spouse or partner and your dependent children including medical, dental, and vision * Life and Income Protection * Fertility and adoption benefits * Headspace mindfulness app subscription * Global Employee Assistance Program * Pension benefits with employer match * Flexible paid time off * 26 weeks paid maternity leave & 12 weeks paid paternity leave * 2 weeks paid family care leave * Annual Tax-Free Stipend * Education reimbursement * Employee donation match to community organizations * 7 Global Employee Resource Groups (ERGs) * Free lunch and snacks * Close proximity to cultural landmarks such as Dublin Castle and St. Patrick's Cathedral CASH COMPENSATION RANGE: €70,000 - €107,800 EUR The base salary for this position will vary based on job-related criteria including relevant skills, experience, and location, among other factors.  In addition to the cash compensation above (which includes base salary and, where applicable for eligible roles, may include overtime pay), Squarespace employees are eligible to be granted an option to purchase our common stock. ABOUT SQUARESPACE Squarespace is a design-driven platform helping entrepreneurs build brands and businesses online. We empower millions of customers in more than 200 countries and territories with all the tools they need to create an online presence, build an audience, monetize, and scale their business. Our suite of products range from websites, domains, ecommerce, and marketing tools, as well as tools for scheduling with Acuity and creating and managing social media presence with Bio Sites and Unfold. Our team of more than 1,700 is headquartered in New York City, with offices in Dublin, Ireland, and Aveiro, Portugal. For more information about our company, visit https://www.squarespace.com/about/careers. OUR COMMITMENT Today, more than a million people around the globe use Squarespace to share different perspectives and experiences with the world. Not only do we embrace and celebrate the diversity of our customer base, but we also strive for the same in our employees. At Squarespace, we are committed to equal employment opportunity regardless of race, color, ethnicity, ancestry, religion, national origin, gender, sex, gender identity or expression, sexual orientation, age, citizenship, marital or parental status, disability, veteran status, or other class protected by applicable law. We are proud to be an equal opportunity workplace. Thank you in advance for providing the following details about your work history from your resume! This helps us ensure that your candidate information is accurate and consistent during the hiring process.   Squarespace will never solicit your personal banking information or ask you to transfer money in connection with a job offer or interview. We also will not reach out to you via phone or SMS without your permission or knowledge.   If you plan to use AI in any capacity during your candidate journey, please review our Candidate AI Policy.

Notion

WHO WE ARE Notion is the collaborative AI workspace where teams and agents think together. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work. ABOUT THE ROLE Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build. We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion. You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next. We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters WHAT YOU'LL ACHIEVE * Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments. * Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety. * Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful. * Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements. * Participate in investigations, incident response, and postmortems that drive long-term security improvements. * Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions. * Participate in a shared on-call rotation for incident response. SKILLS YOU'LL NEED TO BRING * Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting. * Have built and operated production detections with strong signal quality and sustainable tuning processes. * Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther. * Have an offensive security mindset and have led purple team, blue team, or adversary emulation exercises that improved detections and telemetry. * Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection. * Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments. * Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently. NICE TO HAVE * Experience applying LLMs or agent-style tooling to security workflows. * Experience securing AI-enabled systems or endpoint tooling. * Kubernetes or container detection experience. * Background in threat intelligence, malware analysis, or digital forensics. * Contributions to the detection engineering community through research, tooling, or talks. * Experience at a high-growth startup or AI company. Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role's scope and complexity, and the candidate's experience and expertise, and may vary from the range provided below. The estimated base salary range for this role is €127,000–€142,000 per year. By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy. #LI-Onsite A NOTE ON AI You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on. EQUAL OPPORTUNITY & ACCOMMODATIONS We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know. Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.

Notion

WHO WE ARE Notion is the collaborative AI workspace where teams and agents think together. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work. ABOUT THE ROLE Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build. We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion. You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next. We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters WHAT YOU'LL ACHIEVE * Design and maintain high-signal detections across cloud, identity, endpoints, and SaaS environments. * Build and improve the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety. * Develop tooling and automation that accelerate triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful. * Translate threat intelligence and adversary TTPs into durable detections, telemetry requirements, and response improvements. * Participate in investigations, incident response, and postmortems that drive long-term security improvements. * Define and track key metrics such as coverage, MTTD, and alert quality to guide investment decisions. * Participate in a shared on-call rotation for incident response. SKILLS YOU'LL NEED TO BRING * Have 6+ years of experience in detection engineering, security operations, incident response, or threat hunting. * Have built and operated production detections with strong signal quality and sustainable tuning processes. * Are fluent in one or more detection languages such as Sigma, KQL, SPL, YARA-L, EQL, or Panther. * Have an offensive security mindset and have led purple team, blue team, or adversary emulation exercises that improved detections and telemetry. * Have strong cloud security experience in AWS, GCP, or Azure, including identity-focused attack detection. * Are hands-on with SIEM, EDR, and SOAR platforms in large-scale environments. * Communicate clearly through design docs, runbooks, and incident reports, and can drive projects independently. NICE TO HAVE * Experience applying LLMs or agent-style tooling to security workflows. * Experience securing AI-enabled systems or endpoint tooling. * Kubernetes or container detection experience. * Background in threat intelligence, malware analysis, or digital forensics. * Contributions to the detection engineering community through research, tooling, or talks. * Experience at a high-growth startup or AI company Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role’s scope and complexity, and the candidate’s experience and expertise, and may vary from the range provided below. For roles based in San Francisco or New York City, the estimated base salary range for this role is $230,000 - $260,000 per year.   By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy and NYLL 144.   #LI-Onsite A NOTE ON AI You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on. EQUAL OPPORTUNITY & ACCOMMODATIONS We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know. Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.