Application Security Engineer - Threat Modeling Champion

Decisive Point; Warszawa; On-site; PLN 356,000 - 405,000; Full time

Benefits offered by this job

Health insurance

Breakfast and lunch catering

Career growth budget

Home office setup budget

Gym/Fitness card

MacBooks with accessories

Fertility healthcare and family-form"

Mental Health Support

Job summary

Asana is seeking an Application Security Engineer in Warsaw to join a security team that protects employees, users, and customers. You will conduct security design reviews, threat modeling, and vulnerability assessments across products and internal apps, driving secure design decisions and incident response.

You will collaborate with IT, infrastructure, and product teams to embed security into the software lifecycle, delivering training and staying ahead of evolving threats in a fast-paced

Qualifications

• 5+ years of experience in application security, product security, or software engineering with a security focus, with significant experience in security design reviews, threat modeling, and vulnerability assessments.
• Strong software engineering background with experience in languages like Python, JavaScript/TypeScript or Scala.
• Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection.
• Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management.
• Proven experience performing security design reviews and threat modeling for complex, distributed applications, with the ability to identify systemic risk and drive remediation at scale.
• Excellent communication skills for collaborating effectively with both technical and non-technical partners, translating security risk into business impact.
• A pragmatic and collaborative mindset, with a passion for building defenses into the software development lifecycle and enabling other engineers to do their best, most secure work.

Responsibilities

• Conduct security architecture reviews and threat modeling for new features and services across our product and internal applications, identifying risks early and influencing secure design decisions.
• Perform vulnerability assessments of software and systems, using a range of assessment methodologies to surface and prioritize security weaknesses across our product surface.
• Triage, investigate, and drive remediation of vulnerabilities from our bug bounty program and automated security tooling, ensuring issues are tracked and resolved within defined SLAs.
• Influence engineering initiatives by conducting design and roadmap reviews, effectively communicating security constraints, and assisting teams in making informed trade-offs.
• Investigate product security incidents as a subject matter expert, using logs and monitoring tools to assess scope, impact, and root cause.
• Develop and deliver training to educate engineers on secure coding best practices, threat modeling techniques, and emerging threats.
• Stay informed of industry trends, emerging threats, and best practices to ensure that Asana's security posture remains robust and ahead of the threat landscape.
• Collaborate with teammates and stakeholders to develop both short-term and long-term strategies for risk management and security program maturity.
• Join a collaborative Security team composed of specialists in product, application, software engineering, infrastructure and detection and response, all working together to help engineering teams design and ship secure software.

Skills

Security architecture reviews

Threat modeling

Vulnerability assessments

Security design reviews

Communication skills

Collaborative mindset

Tools

Python

JavaScript/TypeScript

Scala

SAST/DAST tools

SCA

Vulnerability management tools

Job description

Asana is seeking an Application Security Engineer in Warsaw to join a security team that protects employees, users, and customers. You will conduct security design reviews, threat modeling, and vulnerability assessments across products and internal apps, driving secure design decisions and incident response.

You will collaborate with IT, infrastructure, and product teams to embed security into the software lifecycle, delivering training and staying ahead of evolving threats in a fast-paced