TPRM Lead: Scale Vendor Security & Risk Program

Asana, Inc.; Vancouver; Hybrid; CAD 123,000 - 140,000; Full time

Benefits offered by this job

Mental health benefits

Career coaching

Retirement plans

Office amenities

Job summary

Asana, Inc. is seeking a Third Party Risk Management Lead in Vancouver to build and scale the TPRM program, from initial due diligence through ongoing monitoring.

You will partner with Procurement, Legal, Privacy, and Engineering to ensure third-party relationships are effectively assessed and managed. This role requires 5+ years in TPRM, strong knowledge of SIG/CAIQ/NIST and SOC 2, and experience reviewing vendor documents.

Qualifications

• 5+ years of experience in third-party risk management or related information security disciplines.
• Strong knowledge of TPRM frameworks and standards (SIG, CAIQ, NIST SP 800-161, ISO 27001, SOC 2).
• Experience reviewing vendor security documentation (audit reports, certifications, penetration test summaries).

Responsibilities

• Own and scale Asana's TPRM program with risk-based framework, tiering, and governance.
• Lead vendor security assessments, review SOC 2 reports, ISO 27001 certifications, security questionnaires, and remediate gaps.
• Drive remediation and risk acceptance, track open findings and ensure timely resolution.
• Manage ongoing third-party monitoring, conduct reassessments, and maintain vendor risk inventory.
• Review security provisions in vendor contracts with Legal and Privacy teams.
• Report program health with metrics for senior leadership and audit support (SOC 2, ISO 27001).
• Coordinate globally across time zones to support vendor assessments and risk decisions.

Skills

TPRM frameworks

Vendor risk assessment

SOC 2 / ISO 27001

Security documentation review

Cross-functional collaboration

Communication skills

Global coordination

Job description

Asana, Inc. is seeking a Third Party Risk Management Lead in Vancouver to build and scale the TPRM program, from initial due diligence through ongoing monitoring.

You will partner with Procurement, Legal, Privacy, and Engineering to ensure third-party relationships are effectively assessed and managed. This role requires 5+ years in TPRM, strong knowledge of SIG/CAIQ/NIST and SOC 2, and experience reviewing vendor documents.