Product Security Engineer - Secure-by-Default, AI Ready

Decisive Point; Vancouver; Hybrid; CAD 176,000 - 200,000; Full time

Benefits offered by this job

Mental health benefits

Career coaching & support

Inclusive family building benefits

Long-term retirement plans

In-office dining options

Job summary

Asana in Vancouver is seeking a Product Security Engineer to join the Product Security team. You will partner with product and infrastructure teams to ensure security is designed and shipped with the software across web, mobile, and AI surfaces.

This role emphasizes scalable security practices, threat modeling, and automated tooling to protect Asana's products. The office-centric hybrid model and collaboration with cross-functional teams define the role’s environment.

Qualifications

• 5+ years of experience in application security, product security, or software engineering with a security focus.
• Strong software engineering background in Python, JavaScript/TypeScript or Scala.
• Deep knowledge of OWASP Top 10 and web vulnerabilities.
• Experience with security design reviews and threat modeling for complex apps.

Responsibilities

• Partner with product and engineering teams across the SDLC to ensure security is designed and built into Asana's products and platform.
• Conduct security architecture reviews, threat modeling, and code reviews for new features and services.
• Develop, implement, and maintain secure-by-default frameworks and libraries that empower engineering teams to build secure systems easily.
• Build and maintain automated security tooling (SAST/DAST, custom checks, and automated red-teaming) to scale security coverage.
• Identify and address AI-specific security risks such as prompt injection and agentic design in AI features.
• Triage, investigate, and drive remediation of vulnerabilities from bug bounty, internal testing, and tooling.
• Influence engineering initiatives by design/roadmap reviews and communicating security constraints.
• Investigate product security incidents as SME, using logs to contain and resolve.
• Evaluate and improve software supply chain security including dependency management and SCA.
• Develop and deliver training to educate engineers on secure coding practices.

Skills

Python

JavaScript/TypeScript

Scala

Threat modeling

Code review

Tools

SAST/DAST tools

SCA

Vulnerability management

Job description

Asana in Vancouver is seeking a Product Security Engineer to join the Product Security team. You will partner with product and infrastructure teams to ensure security is designed and shipped with the software across web, mobile, and AI surfaces.

This role emphasizes scalable security practices, threat modeling, and automated tooling to protect Asana's products. The office-centric hybrid model and collaboration with cross-functional teams define the role’s environment.