Build and operate detection and response systems for Notion’s cloud-native environment. Responsibilities include developing high-signal detections, maintaining detection platforms, automating triage and investigation, applying threat intelligence, participating in incident response, measuring detection effectiveness, and supporting on-call operations. The role also involves collaboration with engineering and infrastructure teams and may include LLM-based security workflows, detection-as-code, threat hunting, and adversary emulation.

Own and improve corporate security engineering controls across identity, endpoints, SaaS, and workforce infrastructure. Harden Okta and Google Workspace, operate endpoint security for macOS and other platforms, govern AI tool usage, reduce SaaS risk, and build Python, Bash, and Terraform automation. Partner with detection and response teams on telemetry, audits, access reviews, onboarding, offboarding, configuration drift, and incidents including phishing, account compromise, lost devices, and business email compromise.