Software Engineer, Infrastructure Security - Notion

Who We Are

Notion is the collaborative AI workspace where teams and agents think together. We're building one place where your knowledge, projects, meetings, and AI tools live side by side. Millions of individuals, small teams, and large companies run their work on Notion.

About the Role

The Infrastructure Security team’s mission is to build a secure-by-default foundation across Notion’s technical stacks. As an IC4 on this team, you’ll own meaningful infrastructure security problems end-to-end: from identifying risk, to designing pragmatic controls, to shipping secure defaults that scale across engineering.

Note: This is a hybrid role based in San Francisco or New York City. We work from our offices on Mondays, Tuesdays, and Thursdays (Anchor Days).

What You'll Achieve

• Proactively enhance the security posture of our AWS accounts and cloud infrastructure.
• Create secure frameworks for secrets management and authentication/authorization.
• Design and deploy robust Identity and Access Management (IAM) solutions.
• Provide guidance and education on security and privacy best practices to cross-functional partners.
• Participate in and drive mitigation strategies during security-related incident response.

Skills You'll Need

• Security architecture: Experience building and maintaining systems to secure cloud architectures (secrets management, IAM).
• Backend/infrastructure development: Ability to write and ship production-grade code to raise the bar on secure systems design.
• Production experience: Ability to debug systems in production and improve components with minimal disruption.
• Risk-based prioritization: Ability to model threats, balance trade-offs, and focus security investments for maximum impact.
• Communication: Empathetic, clear communication in writing and real-time collaboration.

Nice to Haves

• AWS security best practices, zero trust architectures, or deep IAM expertise.
• Data security or privacy engineering experience.
• Experience applying AI tooling to defensive security workflows.
• Participation in security communities or conferences.