Application Security Engineer: Threat Modelling & Secure Design

Asana; Warszawa; Hybrid; PLN 356,004 - 404,550; Full time

Benefits offered by this job

RSUs

Health insurance with dental and 여행 보?

Breakfast and lunch catering

Vacation allowance

Career growth budget

Home office setup budget

Gym/Fitness card

Mental Health Support

Group life insurance

MacBooks with accessories

Job summary

Asana in Warsaw seeks an Application Security Engineer to join our Security team, partnering with IT, infrastructure, and product teams to ensure we design and ship secure software. This role is based in our Warsaw office with a hybrid schedule (office days Mon, Tue, Thu; possible WFH on Wed; Friday depends on work).

We offer a Contract of Employment for Poland. The candidate will conduct security design reviews, threat modelling, and vulnerability assessments, influencing secure design

Qualifications

• 5+ years of experience in application security, product security, or software engineering with a security focus.
• Strong software engineering background in at least one modern language (Python/JS/Scala).
• Deep knowledge of OWASP Top 10 and common web vulnerabilities (XSS, CSRF, SSRF, SQLi).
• Experience with security design reviews, threat modelling, and vulnerability assessments.

Responsibilities

• Conduct security architecture reviews and threat modelling for new features and services across our product and internal applications, identifying risks early and influencing secure design decisions.
• Perform vulnerability assessments of software and systems, using a range of assessment methodologies to surface and prioritize security weaknesses across our product surface.
• Triage, investigate, and drive remediation of vulnerabilities from our bug bounty program and automated security tooling, ensuring issues are tracked and resolved within defined SLAs.
• Influence engineering initiatives by conducting design and roadmap reviews, effectively communicating security constraints, and assisting teams in making informed trade-offs.
• Investigate product security incidents as a subject matter expert, using logs and monitoring tools to assess scope, impact, and root cause.
• Develop and deliver training to educate engineers on secure coding best practices, threat modelling techniques, and emerging threats.
• Stay informed of industry trends, emerging threats, and best practices to ensure that Asana’s security posture remains robust.
• Collaborate with teammates and stakeholders to develop both short-term and long-term strategies for risk management and security programme maturity.
• Join a collaborative Security team composed of specialists in product, application, software engineering, infrastructure, and detection and response.

Skills

Python

JavaScript/TypeScript

Scala

Tools

SAST

DAST

SCA

Job description

Asana in Warsaw seeks an Application Security Engineer to join our Security team, partnering with IT, infrastructure, and product teams to ensure we design and ship secure software. This role is based in our Warsaw office with a hybrid schedule (office days Mon, Tue, Thu; possible WFH on Wed; Friday depends on work).

We offer a Contract of Employment for Poland. The candidate will conduct security design reviews, threat modelling, and vulnerability assessments, influencing secure design