About the company
At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work together effortlessly. Our security team protects Asana's employees, users, and customers by proactively addressing threats and fostering a culture of security throughout our product and operations.
Responsibilities
- Partner with product and engineering teams across the full software development lifecycle to ensure security is designed and built into Asana's products and platform.
- Conduct security architecture reviews, threat modeling, and code reviews for new features and services.
- Develop, implement, and maintain secure-by-default frameworks and libraries.
- Build and maintain automated security tooling (static and dynamic analysis rules, custom SAST/DAST checks, automated red-teaming).
- Identify and address AI-specific security risks such as prompt injection, insecure tool permissions, and abuse-resistant design.
- Triage, investigate, and drive remediation of vulnerabilities from bug bounty, internal testing, and automated tooling.
- Influence engineering initiatives by conducting design and roadmap reviews.
- Investigate product security incidents as a subject matter expert.
- Evaluate and improve software supply chain security, including dependency management, SCA tooling, and third-party risk.
- Develop and deliver training on secure coding best practices.
- Stay informed of industry trends, emerging threats, and best practices.
- Collaborate with teammates and stakeholders on short-term and long-term risk management strategies.
Requirements
- 5+ years of experience in application security, product security, or software engineering with a security focus.
- Strong software engineering background with experience in Python, JavaScript/TypeScript or Scala.
- Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection.
- Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces.
- Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management.
- Experience performing security design reviews and threat modeling for complex applications.
- Excellent communication skills.
- A pragmatic and collaborative mindset.
Conditions
- Based in Vancouver office with an office-centric hybrid schedule.
- Standard in-office days: Monday, Tuesday, Thursday. Option to work from home on Wednesdays.
- Estimated base salary range: 176,000 - 200,000 CAD.
- Compensation package may include equity, sales incentive pay, and benefits.
- Benefits include mental health, wellness & fitness benefits, career coaching, inclusive family building benefits, long-term savings or retirement plans, in-office culinary options.