Application Security Engineer, Notion

• Notion is looking for security engineers that have a passion for making it as easy as possible for developers to write secure code
• Security Architecture expertise: You have at least 3+ years of experience working with product teams to design and/or build secure software
• Thoughtful problem-solving: For you, problem-solving starts with a clear and accurate understanding of the context. You can decompose tricky problems and work towards a clean solution, by yourself or with teammates. You're comfortable asking for help when you get stuck
• Ability to advocate for and lead cross functional projects: You regularly advocate for security hardening projects that you then lead by partnered with product engineering teams to improve the security story of the products you are responsible to secure
• Pragmatic and business-oriented: You care about business impact and prioritize projects accordingly — As a product security expert you communicate and facilitate understand of the threat model and risks with the goal to balance the right security investments with the right bottom line outcomes
• Empathetic communication: You communicate nuanced ideas clearly, whether you're explaining technical decisions in writing or brainstorming in real time. In disagreements, you engage thoughtfully with other perspectives and compromise when needed
• Startup mentality: You are comfortable navigating the fast moving, unstructured nature of a hyper-growth startup. You are self-motivated to add value and bias towards action

Desirable

• As an Application Security Engineer you will be a consultant, advocate and builder that is hyper focused on preventing and eliminating software vulnerabilities across Notion's product suite
• As an early member of Notion’s Application Security team, you will have a large input in defining the direction and goals of the program
• Make the secure path the easy path for product teams by providing design guidance and finding solutions that eliminate classes of vulnerabilities
• Create static and dynamic analysis rules that detect weaknesses in our codebase
• Provide developers guidance and education on security and privacy best practices that prevent the authoring of vulnerabilities
• Participate in and drive mitigation strategies during AppSec related incident responses
• Build and maintain tools that prevent vulnerabilities or automate remediation