Top Cybersecurity Jobs

Build and operate detection and response systems for Notion’s cloud-native environment. Responsibilities include developing high-signal detections, maintaining detection platforms, automating triage and investigation, applying threat intelligence, participating in incident response, measuring detection effectiveness, and supporting on-call operations. The role also involves collaboration with engineering and infrastructure teams and may include LLM-based security workflows, detection-as-code, threat hunting, and adversary emulation.

Join Notion's Detection and Response team as a Security Operations Engineer, focusing on investigating security events and mentoring junior engineers, ensuring operational excellence in security practices.

Own and improve corporate security engineering controls across identity, endpoints, SaaS, and workforce infrastructure. Harden Okta and Google Workspace, operate endpoint security for macOS and other platforms, govern AI tool usage, reduce SaaS risk, and build Python, Bash, and Terraform automation. Partner with detection and response teams on telemetry, audits, access reviews, onboarding, offboarding, configuration drift, and incidents including phishing, account compromise, lost devices, and business email compromise.

Design and implement secure-by-default cloud infrastructure across AWS: build secrets management and IAM solutions, ship production backend changes, model threats and prioritize risk-based controls, guide partners on security and privacy, and participate in incident response and mitigation.

Design and build security foundations for AI products, including agent runtimes, tool permissions, retrieval, content writes, observability, and auditability. Create reusable security libraries, guardrails, test fixtures, and automated red-team testing for prompt injection, data exfiltration, tool misuse, cross-tenant leakage, and unsafe mutations. Translate threat models into engineering requirements and launch criteria, and continuously harden systems using production signals and incident learnings.

Build and maintain corporate security controls across identity, endpoints, and SaaS. Harden IAM (Okta, Google Workspace), run endpoint security for a macOS-first fleet, secure AI tool usage, reduce SaaS risk with SSPM and automation, and write Python/Terraform to automate access reviews, onboarding/offboarding, and audit evidence. Partner with Detection & Response and support SOC 2/ISO 27001 compliance and corporate incident response.