Security Engineer, Corporate Security

Notion•San Francisco, CA

1d•$220,000 - $260,000•Onsite

About The Position

Millions of people rely on Notion to do their most important work. Protecting that trust starts with protecting the people who build Notion: our employees, their laptops, their identities, and the SaaS apps they rely on every day. We are looking for a hands-on Corporate Security Engineer to own and improve the technical controls that keep our workforce and corporate environment safe. This is a security engineering role focused on building scalable controls and automation across identity, endpoints, SaaS, and workforce infrastructure, not a traditional IT support or corporate engineering role. You'll own and evolve core security controls, design systems and automation that scale with the company, and help make security both stronger and easier to use. You'll partner closely with IT, Infrastructure, GRC, and Detection & Response to improve the security foundations that employees rely on every day.

Requirements

Hands-on Corporate Security Engineer role focused on building scalable controls and automation across identity, endpoints, SaaS, and workforce infrastructure.
Own and evolve core security controls.
Design systems and automation that scale with the company.
Partner closely with IT, Infrastructure, GRC, and Detection & Response.
Experience with Okta and Google Workspace.
Experience with macOS, Windows, and ChromeOS endpoint security (MDM, EDR, configuration baselines).
Experience securing AI tool usage at the endpoint, including governance of large language models, AI agents, and model context protocol (MCP) integrations.
Experience with SSPM tooling and custom automation for SaaS risk reduction.
Proficiency in Python and Terraform for automation.
Experience partnering with Detection & Response teams.
Experience supporting SOC 2 and ISO 27001 audits.
Experience with investigation and response for corporate security incidents.

Nice To Haves

Experience at a fast-growing tech or AI company where the security program had to outpace headcount.
A background in IT engineering, SRE, or production engineering that transitioned into security engineering.
Experience building internal security tooling or workflows that improved employee or developer experience.
Contributions to the security community through open-source tools, blog posts, or conference talks.

Responsibilities

Harden our identity and access management stack, including Okta and Google Workspace, with phishing-resistant MFA, strong SSO and SCIM lifecycles, and least-privilege access across SaaS.
Run our endpoint security program across a macOS-first fleet, including MDM, EDR, and configuration baselines, with working coverage for Windows and ChromeOS.
Secure AI tool usage at the endpoint, including governance of large language models, AI agents, and model context protocol (MCP) integrations; detect and prevent unauthorized or risky AI service access and data exfiltration through AI-enabled tools.
Reduce SaaS risk at scale through SSPM tooling and custom automation, including detection of risky OAuth grants, excessive permissions, shadow IT, and configuration drift.
Write code (Python, Terraform) to automate access reviews, onboarding and offboarding, configuration drift detection, and audit evidence collection.
Partner with Detection & Response to ensure corporate systems produce the telemetry needed to detect identity, endpoint, and SaaS abuse.
Support SOC 2, ISO 27001, and customer audits as a byproduct of good engineering, not a separate workstream.
Partner with Detection & Response on investigation and response for corporate security incidents, including phishing, account compromise, lost devices, and BEC.