Security Engineer, Corporate Security - Notion

About the Role

Millions of people rely on Notion to do their most important work. We are looking for a hands-on Corporate Security Engineer to own and improve the technical controls that keep our workforce and corporate environment safe. This role focuses on building scalable controls and automation across identity, endpoints, SaaS, and workforce infrastructure.

What You'll Achieve

• Identity & Access: Harden our IAM stack (Okta, Google Workspace) with phishing-resistant MFA, SSO, and SCIM lifecycles.
• Endpoint Security: Manage our macOS-first fleet (MDM, EDR) with coverage for Windows and ChromeOS.
• AI Governance: Secure AI tool usage, including LLMs, AI agents, and model context protocol (MCP) integrations.
• SaaS Risk Management: Reduce risk via SSPM tooling and custom automation to detect shadow IT and configuration drift.
• Automation: Write production-quality code (Python, Terraform) to automate access reviews, onboarding/offboarding, and audit evidence collection.
• Collaboration: Partner with Detection & Response to ensure corporate systems provide necessary telemetry and assist in incident investigations.
• Compliance: Support SOC 2 and ISO 27001 audits as a byproduct of robust engineering.

Skills You Need To Bring

• 5+ years of experience in corporate, enterprise, or IT security engineering at a cloud-native company.
• Working knowledge of major identity providers (Okta, Entra, or Google Workspace) and protocols (SAML, OIDC, OAuth 2.0, SCIM).
• Hands-on experience with endpoint management and detection tooling.
• Proficiency in Python or Bash and infrastructure-as-code (Terraform).
• Familiarity with SaaS security risks (OAuth governance, audit logging, SSPM).
• Working knowledge of at least one major cloud platform (AWS, GCP, or Azure).
• Strong communication skills to work across IT, Engineering, Legal, and GRC teams.

Nice to Haves

• Experience at a fast-growing tech or AI company.
• Background in IT engineering, SRE, or production engineering.
• Experience building internal security tooling that improves developer experience.
• Contributions to the security community (open-source, blog posts, or talks).