Product Security Engineer

Decisive Point; Warszawa; Hybrid; PLN 346,000 - 402,000; Full time

Benefits offered by this job

Health insurance with dental andtravel

Office-centric hybrid schedule

RSUs and base salary

Meal catering at office

Vacation allowance

Career growth budget

Home office setup budget

MacBook and accessories

Job summary

Asana is seeking a Product Security Engineer to embed security across the software development lifecycle in Warsaw. You will partner with product and infrastructure teams to design and ship secure software, build secure-by-default frameworks, and drive remediation of vulnerabilities from testing and bug bounty programs.

The role is office-centric with hybrid days and a focus on security across web, mobile, and AI-powered surfaces, including AI risk management and security tooling development.

Qualifications

• 5+ years of experience in application security, product security, or software engineering with a security focus.
• Strong software engineering background with Python, JavaScript/TypeScript, or Scala.
• Deep knowledge of OWASP Top 10 and common web vulnerabilities (XSS, CSRF, SSRF, SQLi).
• Familiarity with AI/ML security concepts including prompt injection and agentic attack surfaces.
• Experience with SAST/DAST, SCA tools, and vulnerability management.
• Experience performing security design reviews and threat modeling for complex apps.
• Excellent communication for cross-functional collaboration.

Responsibilities

• Partner with product and engineering teams to embed security in the software development lifecycle.
• Conduct security architecture reviews and threat modeling for new features.
• Develop and maintain secure-by-default frameworks and libraries.
• Build automated security tooling (static/dynamic analysis, SCA) to scale coverage.
• Address AI-specific security risks in AI-powered features.
• Triage and drive remediation of vulnerabilities from bug bounty and testing.
• Influence engineering roadmaps with security constraints and trade-offs.
• Investigate security incidents using logs and monitoring tools.
• Improve software supply chain security and dependency management.
• Deliver training on secure coding and emerging threats.
• Stay updated on threats and industry best practices.

Skills

Security engineering

Python

JavaScript/TypeScript

Scala

Threat modeling

SAST/DAST

AI security

Communication

Security architecture

Tools

Static analysis tools

Dynamic analysis tools

Code review tools

Job description

At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work together effortlessly. Our security team protects Asana's employees, users, and customers by proactively addressing threats and fostering a culture of security throughout our product and operations.

We're looking for a Product Security Engineer to join our Product Security team in Warsaw. You'll be a foundational member of the security presence in a key engineering hub, partnering directly with product and infrastructure teams to ensure we design and ship secure software. You will be instrumental in scaling our security practices by building secure-by-default frameworks, eliminating entire classes of vulnerabilities, and championing a security-first mindset across our web, mobile, and AI-powered product surfaces.

This role is based in our Warsaw office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do, and your recruiter can share more about the in-office requirements.

We offer a Contract of Employment (UoP) for our employees in Poland.

What You'll Achieve

• Partner with product and engineering teams across the full software development lifecycle to ensure security is designed and built into Asana's products and platform.
• Conduct security architecture reviews, threat modeling, and code reviews for new features and services.
• Develop, implement, and maintain secure-by-default frameworks and libraries that empower engineering teams to build secure systems easily.
• Build and maintain automated security tooling (static and dynamic analysis rules, custom SAST/DAST checks, and automated red-teaming) to scale security coverage without scaling headcount.
• Identify and address AI-specific security risks such as prompt injection, insecure tool permissions, and abuse-resistant design in Asana's AI and agentic features.
• Triage, investigate, and drive remediation of vulnerabilities from our bug bounty program, internal testing, and automated security tooling.
• Influence engineering initiatives by conducting design and roadmap reviews, effectively communicating security constraints, and assisting teams in making informed trade-offs.
• Investigate product security incidents as a subject matter expert, using logs and monitoring tools to contain, analyze, and drive resolution.
• Evaluate and improve software supply chain security, including dependency management, SCA tooling, and third-party risk in the development pipeline.
• Develop and deliver training to educate engineers on secure coding best practices and emerging threats.
• Stay informed of industry trends, emerging threats, and best practices to ensure that Asana's security posture remains robust.
• Collaborate with teammates and stakeholders to develop both short-term and long-term strategies for risk management.

About You

• 5+ years of experience in application security, product security, or software engineering with a security focus.
• Strong software engineering background with experience in languages like Python, Javascript/Typescript or Scala.
• Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection.
• Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces.
• Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management.
• Experience performing security design reviews and threat modeling for complex applications.
• Excellent communication skills for collaborating effectively with both technical and non-technical partners.
• A pragmatic and collaborative mindset, with a passion for building defenses against real-world attacks and enabling other engineers to do their best, most secure work.
• Demonstrated curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision-making

What We'll Offer

• Generous, transparent and fair compensation system (base salary and RSUs)
• Contract of Employment (and the option of 50% tax deductible costs for author's rights usage in respect of applicable roles)
• Health insurance with dental and travel coverage (Lux Med)
• Breakfast and lunch catering on the days that you work from the office
• Vacation allowance
• Career growth budget
• Home office setup budget
• Gym/Fitness card
• Fertility healthcare and family-forming support with Carrot
• Mental Health Support in Modern Health
• Group life insurance
• MacBooks with all necessary accessories

For this role, the estimated base salary range is between 31 000 - 36 000 PLN gross per month (subject to all taxes and necessary deductions). The actual base salary will vary based on various factors, including market and individual qualifications objectively assessed during the interview process. The listed range above is a guideline, and the base salary range for this role may be modified.

In addition to base salary, your compensation package may include additional components such as equity and sales incentive pay (for most sales roles), and benefits. If you're interviewing for this role, speak with your recruiter to learn more about the total compensation and benefits for this role.

About Us

Asana is a leading platform for human + AI collaboration. Millions of teams around the world rely on Asana to achieve their most important goals, faster. Asana has been named to Fortune's Best Workplaces for 7+ years and recognized by Fast Company, Forbes, and Gartner for excellence in workplace culture and innovation. We offer an exceptional office-centric culture while adopting the best elements of hybrid models to ensure that every one of our global team members can work together effortlessly. With 13+ offices all over the world, we are always looking for individuals who care about building technology that drives positive change in the world and a culture where everyone feels that they belong.

We believe in supporting people to do their best work and thrive. Our goal is to ensure that Asana upholds an environment where all people feel that they are respected and valued, whether they are applying for an open position or working at the company. We provide equal employment opportunities to all applicants without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by law.

Join Asana's Talent Network

to stay up to date on job opportunities and life at Asana.