Security Engineer, Corporate Security

Who We Are Notion is the collaborative AI workspace where teams and agents think together . We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work. About Us: Notion helps you build beautiful tools for your life’s work. In today's world of endless apps and tabs, Notion provides one place for teams to get everything done, seamlessly connecting docs, notes, projects, calendar, and email—with AI built in to find answers and automate work. Millions of users, from individuals to large organizations like Toyota, Figma, and OpenAI, love Notion for its flexibility and choose it because it helps them save time and money. In-person collaboration is essential to Notion's culture. We require all team members to work from our offices on Mondays, Tuesdays, and Thursdays, our designated Anchor Days. Certain teams or positions may require additional in-office workdays. About the Role: Millions of people rely on Notion to do their most important work. Protecting that trust starts with protecting the people who build Notion: our employees, their laptops, their identities, and the SaaS apps they rely on every day. We are looking for a hands-on Corporate Security Engineer to own and improve the technical controls that keep our workforce and corporate environment safe. This is a security engineering role focused on building scalable controls and automation across identity, endpoints, SaaS, and workforce infrastructure, not a traditional IT support or corporate engineering role. You'll own and evolve core security controls, design systems and automation that scale with the company, and help make security both stronger and easier to use. You'll partner closely with IT, Infrastructure, GRC, and Detection & Response to improve the security foundations that employees rely on every day. What You'll Achieve: Harden our identity and access management stack, including Okta and Google Workspace, with phishing-resistant MFA, strong SSO and SCIM lifecycles, and least-privilege access across SaaS. Run our endpoint security program across a macOS-first fleet, including MDM, EDR, and configuration baselines, with working coverage for Windows and ChromeOS. Secure AI tool usage at the endpoint, including governance of large language models, AI agents, and model context protocol (MCP) integrations; detect and prevent unauthorized or risky AI service access and data exfiltration through AI-enabled tools. Reduce SaaS risk at scale through SSPM tooling and custom automation, including detection of risky OAuth grants, excessive permissions, shadow IT, and configuration drift. Write code (Python, Terraform) to automate access reviews, onboarding and offboarding, configuration drift detection, and audit evidence collection. Partner with Detection & Response to ensure corporate systems produce the telemetry needed to detect identity, endpoint, and SaaS abuse. Support SOC 2, ISO 27001, and customer audits as a byproduct of good engineering, not a separate workstream. Partner with Detection & Response on investigation and response for corporate security incidents, including phishing, account compromise, lost devices, and BEC. Skills You Need To Bring: Have 5+ years of hands-on experience in corporate security, enterprise security, or IT security engineering at a cloud-native company. Have working knowledge of a major identity provider (Okta, Entra, or Google Workspace) and the underlying protocols (SAML, OIDC, OAuth 2.0, SCIM). Have hands-on experience operating endpoint management and detection tooling across macOS and enterprise environments. Write production-quality scripts and automation in Python or Bash, and have shipped Terraform or other infrastructure-as-code for security configuration. Are familiar with SaaS security risks (OAuth governance, audit logging, SSPM) and t