Vendor Risk & Security Lead

Asana, Inc.; Vancouver; Hybrid; CAD 123,000 - 140,000; Full time

Benefits offered by this job

Mental health benefits

Career coaching

Inclusive family building benefits

Long-term savings plan

In‑office dining options

Job summary

Asana is seeking a Third Party Risk Management Lead to own the end-to-end lifecycle of vendor security risk. You will collaborate with Procurement, Legal, Privacy, and Engineering to assess, track, and manage third-party relationships in a secure manner.

The role focuses on building scalable risk frameworks, conducting security assessments (SOC 2, ISO 27001, SIG, CAIQ), driving remediation, and maintaining a global vendor risk inventory across time zones.

Qualifications

• 5+ years in third-party risk management or related information security discipline.
• Knowledge of SIG, CAIQ, NIST SP 800-161, ISO 27001, and SOC 2.
• Experience conducting vendor security assessments and reviewing third-party security documentation (audit reports, certifications).
• Strong communication and cross-functional collaboration skills.

Responsibilities

• Own and scale Asana’s TPRM program: design, implement, and improve framework for vendor risk management.
• Lead vendor security assessments: review SOC 2, ISO 27001, SIG/CAIQ, and remediation.
• Drive remediation and risk acceptance: prioritize remediation and formal risk acceptance when needed.
• Manage ongoing third-party monitoring: continuous monitoring for high-risk vendors and maintain risk inventory.
• Review security provisions in vendor contracts with Legal and Privacy teams.
• Report on TPRM program health to senior leadership and support audits.
• Operate globally: coordinate across timezones and regions.

Skills

Third-party risk

Risk assessments

Vendor security

SOC 2

ISO 27001

NIST SP 800-161

Communication

Cross-functional collaboration

Tools

SIG

CAIQ

Job description

Asana is seeking a Third Party Risk Management Lead to own the end-to-end lifecycle of vendor security risk. You will collaborate with Procurement, Legal, Privacy, and Engineering to assess, track, and manage third-party relationships in a secure manner.

The role focuses on building scalable risk frameworks, conducting security assessments (SOC 2, ISO 27001, SIG, CAIQ), driving remediation, and maintaining a global vendor risk inventory across time zones.