Manager, Offensive Security Warsaw

Asana; Warszawa; On-site; PLN 485,460 - 552,420; Full time

Benefits offered by this job

Health insurance

Career growth budget

MacBooks with accessories

Job summary

Asana is seeking a Manager of Offensive Security in Warsaw to lead a team spanning red team, application security, and vulnerability management. You will own the strategy, grow the function, and work with engineering leadership to secure products and infrastructure.

You’ll mentor engineers, plan roadmaps, and drive hands-on offensive activities while communicating risk to executives and legal teams. The role emphasizes collaboration, security testing, and scalable secure design decisions within

Qualifications

• 8+ years in offensive security or related disciplines with hands-on red team/web app pentesting in enterprise environments.
• 3+ years managing and mentoring a team of offensive or application security engineers, actively involved in technical execution.
• Proven track record leading end-to-end security assessments and maturing a vulnerability management program (including bug bounty ownership).
• Deep technical expertise in modern web application security flaws (OWASP Top 10 and beyond) and hands-on cloud security assessments.
• Ability to read and understand source code across Python, Java, JavaScript/TypeScript, Go, and C/C++ to identify security weaknesses.
• Strong understanding of CVEs/CWEs/CVSS and hands-on experience with offensive tooling, red team frameworks, and SAST/DAST/SCA platforms.
• Exceptional ability to translate complex vulnerabilities into executive-level risk reports for leadership and legal.

Responsibilities

• Lead, grow, and mentor a team of offensive security engineers across red team, app security, and vulnerability management while staying hands-on.
• Define team roadmap, OKRs, and priorities aligned with security and engineering strategy.
• Foster technical excellence, learning, and psychological safety while scaling the team with recruiting.
• Plan and execute red team operations and adversary simulations across Asana's infrastructure, products, and corporate environment.
• Perform cloud security assessments evaluating misconfigurations and privilege escalation.
• Develop and maintain red team tooling, TTPs, and playbooks aligned with threat actor behaviors.
• Oversee security architecture reviews and threat modeling for new features and services.
• Own and operate bug bounty and mature vulnerability management across software and infrastructure.
• Implement security controls within the SDLC, including PR blockers and automated gates.
• Translate vulnerabilities into executive risk reports for senior leadership and legal.

Skills

Offensive security

Team leadership

Security assessments

Vulnerability management

Executive reporting

Cloud security

Source code review

Tools

SAST/DAST tools

Red team frameworks

Threat modeling tools

Job description

The Security team is responsible for protecting Asana’s employees, users, and customers. We are a team of security engineers and risk and compliance practitioners who build innovative safeguards to ensure that our data is protected against threats and that we comply with legal, regulatory, and customer requirements. We collaborate closely with teams across the organization to foster a culture of security throughout our product and operations. We're looking for a Manager of Offensive Security to lead our Offensive Security function in Warsaw. In this role, you will own and grow a team spanning red team operations, application security, and vulnerability management, driving both the strategic direction and the hands‑on execution of our offensive security program. You will work directly with engineering leadership, legal, and senior stakeholders to ensure our security posture is continuously tested, measured, and improved.

This role is based in our Warsaw office with an office-centric hybrid schedule. The standard in‑office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do, and your recruiter can share more about the in‑office requirements. We offer a Contract of Employment (UoP) for our employees in Poland.

What you’ll achieve

• Lead, grow, and mentor a team of offensive security engineers across red team, application security, and vulnerability management disciplines while staying actively engaged in day‑to‑day technical operations.
• Define team roadmap, OKRs, and priorities in alignment with broader security and engineering strategy.
• Foster a culture of technical excellence, continuous learning, and psychological safety within the team, partnering with recruiting to scale the team.
• Plan and execute red team operations and adversary simulation exercises across Asana's infrastructure, products, and corporate environment.
• Perform cloud security assessments evaluating misconfigurations, privilege escalation paths, and lateral movement opportunities.
• Develop and maintain red team tooling, TTPs, and playbooks aligned with current threat actor behaviors.
• Oversee security architecture reviews and threat modeling for new features and services, ensuring risks are identified early and secure design decisions are made.
• Own and operate Asana's bug bounty program and mature our vulnerability management program across software and infrastructure.
• Implement technical security controls within the SDLC, including PR blockers and automated pipeline gates.
• Translate complex technical vulnerabilities into executive‑level risk reports and actionable business insights for senior leadership and legal.

About you

• Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision‑making.
• 8+ years of experience in offensive security, application security, or closely related disciplines, with significant hands‑on depth in red team operations or web application penetration testing in enterprise environments.
• 3+ years of demonstrated experience managing and mentoring a team of offensive or application security engineers, while remaining actively involved in technical execution.
• Proven track record of leading end‑to‑end security assessments and operating/maturing a vulnerability management program at scale (including bug bounty ownership).
• Deep technical expertise in modern web application security flaws (OWASP Top 10 and beyond) and hands‑on experience conducting cloud security assessments.
• Ability to read and understand source code across multiple languages (Python, Java, JavaScript/TypeScript, Go, C/C++) to identify security weaknesses and advise on secure patterns.
• Strong understanding of vulnerability taxonomies (CVEs, CWEs, CVSS scoring) and hands‑on experience with offensive tooling, red team frameworks, and SAST/DAST/SCA platforms.
• Exceptional ability to translate complex technical vulnerabilities into executive‑level risk reports and actionable business insights for non‑technical leadership and legal.

At Asana, we're committed to building teams that include a variety of backgrounds, perspectives, and skills, as this is critical to helping us achieve our mission. If you're interested in this role and don't meet every listed requirement, we still encourage you to apply.

What we’ll offer

• Generous, transparent and fair compensation system (base salary and RSUs)
• Contract of Employment (and the option of 50% tax deductible costs for author’s rights usage in respect of applicable roles)
• Health insurance with dental and travel coverage (Lux Med)
• Breakfast and lunch catering on the days that you work from the office
• Vacation allowance
• Career growth budget
• Home office setup budget
• Gym/Fitness card
• Fertility healthcare and family‑forming support with Carrot
• Mental Health Support in Modern Health
• Group life insurance
• MacBooks with all necessary accessories

For this role, the estimated base salary range is between 43,500 - 49,500 PLN gross per month (subject to all taxes and necessary deductions). The actual base salary will vary based on various factors, including market and individual qualifications objectively assessed during the interview process. The listed range above is a guideline, and the base salary range for this role may be modified.

In addition to base salary, your compensation package may include additional components such as equity and sales incentive pay (for most sales roles), and benefits. If you're interviewing for this role, speak with your recruiter to learn more about the total compensation and benefits for this role.

#LI-Hybrid

About us

Asana is a leading platform for human + AI collaboration. Millions of teams around the world rely on Asana to achieve their most important goals, faster. Asana has been named to Fortune's Best Workplaces for 7+ years and recognized by Fast Company, Forbes, and Gartner for excellence in workplace culture and innovation. We offer an exceptional office‑centric culture while adopting the best elements of hybrid models to ensure that every one of our global team members can work together effortlessly. With 13+ offices all over the world, we are always looking for individuals who care about building technology that drives positive change in the world and a culture where everyone feels that they belong.