The opportunity
Notion is looking for an experienced engineer who has designed and built secure software systems to help define the security foundations for our AI products. You’ll work with product and engineering teams on agent runtimes, tool permissions, retrieval, content writes, observability, and abuse-resistant design.
What you'll do
Define and build security architecture for product surfaces that operate: across customer workspace content, including tool execution, content writes, retrieval, permission checks, provenance, and auditability.
Make the secure path the easy path for product teams by shipping reusable: libraries, review patterns, test fixtures, and guardrails that prevent classes of vulnerabilities.
Build automated red-team and regression testing for risks such as prompt: injection, indirect instruction following, data exfiltration, tool misuse, cross-tenant leakage, and unsafe workspace mutations.
Translate threat models for new product surfaces into concrete engineering: requirements, production checks, and launch criteria.
Use production signals, incident learnings, and targeted experiments to: harden Notion over time, then feed those learnings back into architecture and developer workflows.
Help define the security bar for how engineers use coding agents, MCP-enabled: tools, hooks, and internal automation without introducing new risk.
What they're looking for
- Secure software engineering craft: You have 8-10+ years of experience designing, building, or securing complex software systems, and you are comfortable working in production code with product and platform engineers.
- Security architecture judgment: You can look at a complex system and reason about where the permissions, data flow, or trust boundaries are likely to get weird, and help re-design it to make them better.
- Security product strategy: You can turn a complex security risk you see into a product design or architecture that can be built.
- Builder mindset: You’d rather leave behind a useful tool, test, library, or pattern than a task or project for someone else to pick up later.
