Security Engineer (Corporate Security)

• Millions of people rely on Notion to do their most important work
• Protecting that trust starts with protecting the people who build Notion: our employees, their laptops, their identities, and the SaaS apps they rely on every day
• We are looking for a hands-on Corporate Security Engineer to own and improve the technical controls that keep our workforce and corporate environment safe
• This is a security engineering role focused on building scalable controls and automation across identity, endpoints, SaaS, and workforce infrastructure, not a traditional IT support or corporate engineering role
• You’ll own and evolve core security controls, design systems and automation that scale with the company, and help make security both stronger and easier to use
• You’ll partner closely with IT, Infrastructure, GRC, and Detection & Response to improve the security foundations that employees rely on every day
• Harden our identity and access management stack, including Okta and Google Workspace, with phishing-resistant MFA, strong SSO and SCIM lifecycles, and least-privilege access across SaaS
• Run our endpoint security program across a macOS-first fleet, including MDM, EDR, and configuration baselines, with working coverage for Windows and ChromeOS
• Secure AI tool usage at the endpoint, including governance of large language models, AI agents, and model context protocol (MCP) integrations; detect and prevent unauthorized or risky AI service access and data exfiltration through AI-enabled tools
• Reduce SaaS risk at scale through SSPM tooling and custom automation, including detection of risky OAuth grants, excessive permissions, shadow IT, and configuration drift
• Write code (Python, Terraform) to automate access reviews, onboarding and offboarding, configuration drift detection, and audit evidence collection
• Partner with Detection & Response to ensure corporate systems produce the telemetry needed to detect identity, endpoint, and SaaS abuse
• Support SOC 2, ISO 27001, and customer audits as a byproduct of good engineering, not a separate workstream
• Partner with Detection & Response on investigation and response for corporate security incidents, including phishing, account compromise, lost devices, and BEC

Preferred experience

• Communicate clearly in writing and work effectively across IT, Engineering, Legal, People, and GRC
• Write production-quality scripts and automation in Python or Bash, and have shipped Terraform or other infrastructure-as-code for security configuration
• Have hands-on experience operating endpoint management and detection tooling across macOS and enterprise environments
• Are familiar with SaaS security risks (OAuth governance, audit logging, SSPM) and the realities of integrating a long tail of vendors
• Have 5+ years of hands-on experience in corporate security, enterprise security, or IT security engineering at a cloud-native company
• Have working knowledge of at least one major cloud platform (AWS, GCP, or Azure) at the security configuration level
• Have working knowledge of a major identity provider (Okta, Entra, or Google Workspace) and the underlying protocols (SAML, OIDC, OAuth 2.0, SCIM)
• If you’re excited about a role but your past experience doesn’t align perfectly with every bullet point listed in the job description, we still encourage you to apply
• Experience at a fast-growing tech or AI company where the security program had to outpace headcount
• A background in IT engineering, SRE, or production engineering that transitioned into security engineering
• Experience building internal security tooling or workflows that improved employee or developer experience
• Contributions to the security community through open-source tools, blog posts, or conference talks