Vendor Security & TPRM Lead

Asana; Warszawa; Hybrid; PLN 253,890 - 304,110; Full time

Benefits offered by this job

Health insurance

Meals reimbursement

Career growth budget

Home office setup budget

Gym reimbursement

Mental health support

Group life insurance

MacBook

Job summary

Asana is seeking a Third Party Risk Management Lead in Warsaw to own the end-to-end vendor risk lifecycle. You’ll work with Procurement, Legal, Privacy, and Engineering to ensure third-party relationships are assessed, tracked, and managed effectively.

You will design a risk-based framework, oversee security due diligence, and drive remediation while maintaining a global monitoring program. Hybrid, office-based with WFH options.

Qualifications

• 5+ years of experience in third-party risk management, vendor risk assessment, or a related information security discipline.
• Strong knowledge of TPRM frameworks and standards, including SIG, CAIQ, NIST SP 800-161, ISO 27001, and SOC 2.
• Experience conducting vendor security assessments and reviewing third-party security documentation (audit reports, certifications, penetration test summaries, etc.).
• Solid understanding of core security principles, cloud environments, data privacy, and compliance standards relevant to B2B SaaS organizations.
• Proven ability to build and operationalize scalable risk management processes and develop metrics for tracking program effectiveness.
• Excellent communication skills, with the ability to translate technical risk findings into clear, actionable language for both technical and non-technical audiences.
• Experience collaborating cross-functionally with Procurement, Legal, Privacy, and Engineering teams.

Responsibilities

• Own and scale Asana’s TPRM program: Design, implement, and continuously improve a risk-based framework for assessing and managing third‑party vendors and service providers.
• Lead vendor security assessments: Conduct and oversee security due diligence for new and existing vendors, including reviewing SOC 2 reports, ISO 27001 certifications, security questionnaires (SIG, CAIQ), and other relevant documentation.
• Drive remediation and risk acceptance: Track and manage open findings from vendor assessments, prioritize remediation, and facilitate formal risk acceptance processes where appropriate.
• Manage ongoing third-party monitoring: Develop and execute a continuous monitoring strategy for critical and high-risk vendors, including periodic reassessments, breach notifications, and security posture updates.
• Review security provisions in vendor contracts: Collaborate with Legal and Privacy teams to assess and negotiate security-related clauses in vendor agreements, data processing addenda, and subprocessor agreements.
• Report on TPRM program health: Develop metrics and reporting to communicate the state of third-party risk to senior leadership and relevant stakeholders.
• Operate globally: Work with a global team to ensure coverage across timezones and regions.

Skills

TPRM frameworks

Vendor risk assessment

SOC 2

ISO 27001

SIG/CAIQ

NIST SP 800-161

Cross-functional collaboration

Job description

Asana is seeking a Third Party Risk Management Lead in Warsaw to own the end-to-end vendor risk lifecycle. You’ll work with Procurement, Legal, Privacy, and Engineering to ensure third-party relationships are assessed, tracked, and managed effectively.

You will design a risk-based framework, oversee security due diligence, and drive remediation while maintaining a global monitoring program. Hybrid, office-based with WFH options.