Security Engineer, Corporate Security

Security Engineer · Mid · Full Time

Dublin, IrelandUSD 160k – 220k1mo ago

Opens Notion's application page

Role

What you'll do.

Security Engineer at Notion focuses on designing and implementing scalable technical controls across identity, endpoints, SaaS applications, and corporate infrastructure. This hands-on security engineering role requires 5+ years of experience in corporate security or IT security engineering, with proficiency in identity management platforms like Okta or Google Workspace, endpoint detection and response (EDR) tools, and infrastructure-as-code automation. The engineer will partner with IT, Infrastructure, and Detection & Response teams to protect Notion's workforce environment while building security systems that scale with company growth and support compliance frameworks like SOC 2 and ISO 27001.

Responsibilities

Identity and Access Management (IAM) Architecture: Design, harden, and maintain Notion's identity and access management infrastructure using Okta and Google Workspace. Implement phishing-resistant multi-factor authentication (MFA), establish strong single sign-on (SSO) and System for Cross-domain Identity Management (SCIM) lifecycle policies, and enforce least-privilege access controls across the SaaS application portfolio. Configure and monitor SAML, OIDC, and OAuth 2.0 protocols to ensure secure authentication flows and prevent unauthorized access. Conduct regular security reviews of IAM configurations to identify and remediate privilege escalation risks.
Endpoint Security Program Ownership: Own and evolve the corporate endpoint security program across a macOS-first fleet with support for Windows and ChromeOS. Deploy and manage mobile device management (MDM) solutions, endpoint detection and response (EDR) agents, and establish standardized security configuration baselines. Monitor endpoint compliance, investigate security alerts, and coordinate remediation efforts across the organization. Ensure device hardening standards align with corporate security policies while maintaining employee productivity and system usability.
AI Tool Security and Governance: Develop and implement security controls for artificial intelligence and machine learning tool usage across the enterprise. Establish governance frameworks for large language models, AI agents, and model context protocol (MCP) integrations to prevent unauthorized access and data exfiltration risks. Monitor and detect risky AI service access patterns, implement endpoint-level controls to prevent sensitive data exposure through AI-enabled applications, and maintain an up-to-date inventory of AI tools in use across the organization.
SaaS Security and Risk Management: Reduce SaaS application security risks at scale using SaaS security posture management (SSPM) tools and custom automation. Identify and remediate risky OAuth grants, excessive user permissions, shadow IT applications, and configuration drift across the SaaS environment. Build automated detection workflows to identify non-compliant application configurations, implement corrective actions, and maintain audit logs for compliance reporting. Partner with business units to balance security requirements with operational needs.
Infrastructure-as-Code and Security Automation: Write production-quality security automation and infrastructure-as-code in Python, Bash, and Terraform. Build systems to automate access reviews, employee onboarding and offboarding workflows, configuration drift detection, and compliance audit evidence collection. Develop tooling that improves security visibility and reduces manual security operations tasks. Ensure all automation is well-tested, documented, and maintainable by the security team.
Security Telemetry and Detection Engineering: Partner with the Detection and Response team to ensure corporate systems generate sufficient telemetry for identifying identity abuse, endpoint compromises, and SaaS misuse. Define logging requirements for IAM, endpoint management, and cloud infrastructure components. Implement centralized log collection and analysis to support security incident detection and investigation capabilities. Optimize telemetry collection to balance security visibility with performance and cost considerations.
Compliance and Audit Support: Support SOC 2 Type II, ISO 27001, and customer security audits by maintaining comprehensive security control documentation and evidence collection. Automate audit evidence gathering to reduce manual effort and ensure consistent compliance reporting. Work with security and audit teams to address audit findings and implement remediation strategies. Treat compliance as a byproduct of sound security engineering practices rather than a separate operational workstream.
Security Incident Response: Participate in corporate security incident response activities alongside the Detection and Response team. Investigate and respond to security incidents including phishing attacks, account compromises, lost or stolen devices, and business email compromise (BEC) attempts. Conduct root cause analysis, implement preventive measures, and communicate findings to relevant stakeholders. Continuously improve incident response processes based on lessons learned.
Cross-Functional Security Collaboration: Work effectively across IT, Engineering, Legal, People Operations, and GRC teams to align security controls with business objectives. Communicate complex security concepts clearly in writing and presentations to both technical and non-technical audiences. Serve as a trusted security advisor to corporate functions and help drive security awareness across the organization. Build strong relationships with stakeholders to support company growth while maintaining a strong security posture.

Qualifications

What we look for.

Technical

Identity Provider Management
Demonstrated hands-on expertise with major identity providers including Okta, Microsoft Entra ID, or Google Workspace. Proficiency with authentication protocols such as SAML, OIDC, OAuth 2.0, and SCIM. Ability to design and implement secure SSO configurations, MFA strategies, and access control policies at scale.
Endpoint Management and Detection
Working knowledge of endpoint device management (MDM) and endpoint detection and response (EDR) tooling across macOS and enterprise Windows environments. Experience configuring security baselines, monitoring endpoint compliance, and responding to endpoint security alerts. Familiarity with endpoint configuration management tools and hardening standards.
SaaS Security and SSPM
Understanding of SaaS application security risks including OAuth governance, excessive permission granting, shadow IT discovery, and configuration drift. Experience with SaaS security posture management (SSPM) platforms or custom automation approaches. Knowledge of application risk assessment methodologies and vendor security evaluation.
Cloud Platform Security
Working knowledge of at least one major cloud platform (AWS, Google Cloud Platform, or Microsoft Azure) at the security configuration and governance level. Ability to implement cloud identity and access management, network security controls, and security monitoring. Understanding of cloud-native security tools and best practices.
Infrastructure-as-Code and Automation
Production-level proficiency writing scripts and automation in Python or Bash. Demonstrated experience shipping infrastructure-as-code using Terraform or similar tools for security configuration and control deployment. Ability to design maintainable, well-documented automation that scales with organizational growth.
Security Operations and Tooling
Experience operating security tools including log aggregation platforms, SIEM systems, and detection engineering tools. Understanding of telemetry requirements for security visibility and incident response. Ability to integrate multiple security tools and platforms into cohesive security operations workflows.

Education

Relevant Degree or Equivalent Experience
Bachelor's degree in Computer Science, Cybersecurity, Information Security, or related field, OR equivalent hands-on security engineering experience. Advanced certifications such as CISSP, CCSK, or similar are valued but not required; hands-on experience is prioritized over certifications.

Experience

Corporate or Enterprise Security Engineering
Minimum 5+ years of hands-on experience in corporate security, enterprise security, or IT security engineering roles. Preference for experience at cloud-native, fast-growing, or AI-focused technology companies where security programs scaled rapidly alongside organizational growth. Demonstrated track record of building and maintaining security controls that protect workforce environments.
Identity and Access Management Implementation
Hands-on experience designing and implementing identity management solutions, including SSO deployments, MFA rollouts, and access lifecycle management. Proven ability to manage identity governance at scale and remediate IAM security findings from audits and assessments.
Endpoint Security Program Development
Experience building or managing comprehensive endpoint security programs including device management, configuration management, and endpoint detection. Understanding of the operational challenges of securing diverse device fleets while maintaining user productivity.
Security Automation and Tooling Development
Track record of designing and implementing security automation to reduce manual effort and improve control coverage. Experience integrating multiple security tools, building custom workflows, and maintaining security automation infrastructure.

Skills

Required

Python Programming
Write production-quality Python code for security automation, including access control scripts, log analysis, and integration workflows. Ability to design Pythonic solutions that are maintainable and scalable for security operations teams.
Okta or Google Workspace Administration
Expert-level administration and configuration of Okta or Google Workspace identity platforms. Proficiency with provisioning, SSO setup, MFA implementation, and API-driven automation for identity lifecycle management.
macOS System Administration
Hands-on experience managing macOS devices at scale, including deployment, configuration management, security hardening, and compliance monitoring. Knowledge of macOS-specific security features and tools.
Endpoint Detection and Response (EDR)
Operational experience with EDR platforms for threat detection, investigation, and response on corporate endpoints. Ability to configure detection rules, investigate security alerts, and coordinate endpoint remediation.
Terraform Infrastructure-as-Code
Proficiency writing Terraform code to deploy and manage security infrastructure, configurations, and controls. Ability to design modular, reusable Terraform modules for security automation at scale.
OAuth and OIDC Security
Deep understanding of OAuth 2.0 and OpenID Connect security best practices, common misconfigurations, and attack vectors. Ability to audit application OAuth implementations and identify risky permission grants.
SaaS Application Security Assessment
Ability to evaluate SaaS applications for security risks, including configuration review, permission analysis, and compliance assessment. Experience working with multiple SaaS vendors to implement security requirements.
Technical Communication
Clear written and verbal communication skills for explaining complex security concepts to both technical and non-technical stakeholders. Ability to document security controls, incidents, and architectural decisions for various audiences.

Preferred

Bash and Shell Scripting
Nice to have
Proficiency writing Bash scripts for system administration, log analysis, and security operations automation. Ability to deploy scripts across diverse endpoint environments.
AWS or GCP Security Configuration
Nice to have
Hands-on experience configuring security controls in AWS or Google Cloud Platform, including IAM, network security, and cloud monitoring. Understanding of cloud-native security best practices.
SaaS Security Posture Management (SSPM)
Nice to have
Experience with SSPM tools or frameworks for assessing and managing SaaS application security configurations at scale. Familiarity with SSPM implementation challenges and automation opportunities.
Open Source Security Contributions
Nice to have
Active participation in the security community through open-source tool contributions, security research, blog posts, or conference presentations. Demonstrated thought leadership in areas such as identity security or corporate security engineering.
SRE or Production Engineering Background
Nice to have
Previous experience in Site Reliability Engineering (SRE) or production engineering roles that transitioned into security engineering. Strong operational experience, infrastructure knowledge, and understanding of systems at scale.
Internal Security Tooling Development
Nice to have
Experience building custom internal security tools or workflows that improved employee experience, developer productivity, or security operations efficiency. Portfolio of security tools demonstrating design and implementation skills.
AI Security and Governance
Nice to have
Emerging expertise in securing artificial intelligence and machine learning tool usage in enterprise environments. Knowledge of LLM security risks, AI agent governance, and preventing data exfiltration through AI-enabled applications.
Zero Trust Architecture
Nice to have
Familiarity with zero trust security principles and experience implementing zero trust components such as phishing-resistant MFA, least-privilege access, and continuous verification across identity and endpoint layers.
Windows and ChromeOS Administration
Nice to have
Hands-on experience managing Windows and ChromeOS devices in enterprise environments, including configuration management, security baseline implementation, and compliance monitoring.
SCIM and User Lifecycle Automation
Nice to have
Expert knowledge of SCIM protocol implementation for automated user provisioning and deprovisioning. Experience building robust onboarding and offboarding workflows that maintain security and compliance.

Compensation

Pay and benefits.

Base·USD 160,000 – 220,000

Full posting

Original listing.

Who We Are

Notion is the collaborative AI workspace where teams and agents think together. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion.

Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work.

About Us:

Notion helps you build beautiful tools for your life’s work. In today's world of endless apps and tabs, Notion provides one place for teams to get everything done, seamlessly connecting docs, notes, projects, calendar, and email—with AI built in to find answers and automate work. Millions of users, from individuals to large organizations like Toyota, Figma, and OpenAI, love Notion for its flexibility and choose it because it helps them save time and money.

In-person collaboration is essential to Notion's culture. We require all team members to work from our offices on Mondays, Tuesdays, and Thursdays, our designated Anchor Days. Certain teams or positions may require additional in-office workdays.

About the Role:

Millions of people rely on Notion to do their most important work. Protecting that trust starts with protecting the people who build Notion: our employees, their laptops, their identities, and the SaaS apps they rely on every day.

We are looking for a hands-on Corporate Security Engineer to own and improve the technical controls that keep our workforce and corporate environment safe. This is a security engineering role focused on building scalable controls and automation across identity, endpoints, SaaS, and workforce infrastructure, not a traditional IT support or corporate engineering role.

You'll own and evolve core security controls, design systems and automation that scale with the company, and help make security both stronger and easier to use. You'll partner closely with IT, Infrastructure, GRC, and Detection & Response to improve the security foundations that employees rely on every day.

What You'll Achieve:

Harden our identity and access management stack, including Okta and Google Workspace, with phishing-resistant MFA, strong SSO and SCIM lifecycles, and least-privilege access across SaaS.
Run our endpoint security program across a macOS-first fleet, including MDM, EDR, and configuration baselines, with working coverage for Windows and ChromeOS.
Secure AI tool usage at the endpoint, including governance of large language models, AI agents, and model context protocol (MCP) integrations; detect and prevent unauthorized or risky AI service access and data exfiltration through AI-enabled tools.
Reduce SaaS risk at scale through SSPM tooling and custom automation, including detection of risky OAuth grants, excessive permissions, shadow IT, and configuration drift.
Write code (Python, Terraform) to automate access reviews, onboarding and offboarding, configuration drift detection, and audit evidence collection.
Partner with Detection & Response to ensure corporate systems produce the telemetry needed to detect identity, endpoint, and SaaS abuse.
Support SOC 2, ISO 27001, and customer audits as a byproduct of good engineering, not a separate workstream.
Partner with Detection & Response on investigation and response for corporate security incidents, including phishing, account compromise, lost devices, and BEC.

Skills You Need To Bring:

Have 5+ years of hands-on experience in corporate security, enterprise security, or IT security engineering at a cloud-native company.
Have working knowledge of a major identity provider (Okta, Entra, or Google Workspace) and the underlying protocols (SAML, OIDC, OAuth 2.0, SCIM).
Have hands-on experience operating endpoint management and detection tooling across macOS and enterprise environments.
Write production-quality scripts and automation in Python or Bash, and have shipped Terraform or other infrastructure-as-code for security configuration.
Are familiar with SaaS security risks (OAuth governance, audit logging, SSPM) and the realities of integrating a long tail of vendors.
Have working knowledge of at least one major cloud platform (AWS, GCP, or Azure) at the security configuration level.
Communicate clearly in writing and work effectively across IT, Engineering, Legal, People, and GRC.

Nice to Haves:

Experience at a fast-growing tech or AI company where the security program had to outpace headcount.
A background in IT engineering, SRE, or production engineering that transitioned into security engineering.
Experience building internal security tooling or workflows that improved employee or developer experience.
Contributions to the security community through open-source tools, blog posts, or conference talks.

We hire talented and passionate people from a variety of backgrounds because we want our global employee base to represent the wide diversity of our customers. If you’re excited about a role but your past experience doesn’t align perfectly with every bullet point listed in the job description, we still encourage you to apply. If you’re a builder at heart, share our company values, and enthusiastic about making software toolmaking ubiquitous, we want to hear from you.

Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.

By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy .

#LI-Onsite

A Note on AI

You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on.

Equal Opportunity & Accommodations

We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know.

Interview prep

11 guides for Notion

Apply for this position

Redirects to Notion's application page.

Other roles

More at Notion.

View all 13 roles