Threat Intel Lead

About Us:

We're on a mission to make it possible for every person, team, and company to be able to tailor their software to solve any problem and take on any challenge. Computers may be our most powerful tools, but most of us can't build or modify the software we use on them every day. At Notion, we want to change this with focus, design, and craft.

We've been working on this together since 2016, and have customers like Pixar, Mitsubishi, Figma, Plaid, Match Group, and thousands more on this journey with us. Today, we're growing fast and excited for new teammates to join us who are the best at what they do. We're passionate about building a company as diverse and creative as the millions of people Notion reaches worldwide.

About The Role:

We’re looking for a Threat Intelligence expert to lead our program; providing automation that gathers researched Indicators of Compromise (IOCs) and automatically correlates within our SIEM and other response systems.

You’ll be joining Notion’s security team at a very exciting time! We are developing our capabilities mindfully and growing rapidly to meet the needs of our expanding customer base. You’ll be the tip of the spear when it comes to collecting & disseminating intel to both the business and Notion’s security organization.

What You'll Achieve:

• Get to know Notion’s data, good security detection doesn’t happen overnight, it requires heavy analysis to ensure our Monitoring and Response team is proactively defending against legitimate threats to Notion and our customers
• Keep us up to date on latest attack methodologies and provide insight into 3rd party risks.
• Build out threat sharing capabilities
• Scrape the dark web and other underground forums for intelligence related to Notion and our customers
• Work closely with our security engineering teams to instrument logs for security purposes
• Design and deploy tripwires to gather intel such as honeypots and tokens.
• Develop project requirements and success criteria autonomously for highly visible initiatives working closely with various stakeholders.
• Develop reporting for leadership and documenting risks to the organization in order to help us make better decisions for our program and our organization

Skills You'll Need to Bring:

• 4-5 years working working in security operations; specifically designing and implementing a Threat Intelligence program. Can easily talk to the different types of threat intel.
• Have working experience being part of an Incident Response team participating in an on-call rotation.
• 3-5 years experience working with an advance query language (Splunk, SQL, SumoLogic) leveraging it to write complex queries for data enrichment and correlation.
• Strong understanding of data analysis and automation, both engineering and security
• Comfortable writing integrations between systems utilizing an API.

Nice to Haves:

• Experience presenting technical information and intelligence to medium sized audiences
• Developed detections specifically using Splunk’s advanced query language
• Proficient in a scripting or programming language (Python, Go, Bash, etc…)

Our customers come from all walks of life and so do we. We hire great people from a wide variety of backgrounds, not just because it's the right thing to do, but because it makes our company stronger. If you share our values and our enthusiasm for small businesses, you will find a home at Notion.

Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.

#LI-Onsite