Lead Security Risk Architect (Data-Driven)

Asana; San Francisco, Northern (CA, KY); Hybrid; USD 202,000 - 230,000; Full time

Benefits offered by this job

Mental health benefits

Career coaching

Family building benefits

Long-term retirement plans

In-office dining options

Job summary

Asana seeks a senior Security Risk Engineer to own and scale Asana's internal risk program, building quantitative, automated foundations for decision-making. You will partner with Legal, Privacy, Finance, and Engineering and communicate risk to executives.

The role is based in San Francisco with office-centric hybrid schedule; in-office Mon/Tue/Thu with potential WFH on Wed. Competitive base salary and equity+benefits offered.

Qualifications

• 7+ years of information security experience focused on risk management and GRC.
• Proven track record leading a security risk program.
• Experience with quantitative risk methods and risk modeling with numbers.
• Hands-on scripting or automation for data pipelines and risk monitoring.
• Deep knowledge of NIST CSF, NIST SP 800-30, ISO 27001, SOC 2, and FedRAMP.
• Ability to develop risk metrics and executive-level reporting.
• Strong communication skills for both engineering teams and C-suite.

Responsibilities

• Own security risk management program with quantitative framework and risk appetite thresholds.
• Maintain living risk register with KRIs and risk remediation ownership.
• Automate risk identification through data pipelines from scanners, cloud tooling, SIEMs, and third-party sources.
• Deliver executive dashboards communicating risk in business terms to inform decisions.
• Partner with Legal, Privacy, Finance, and Engineering on risk awareness across the company.

Skills

Security risk management

GRC

Quantitative risk methodologies (FAIR)

Risk scoring models

Automation scripting

NIST CSF

ISO 27001

SOC 2

FedRAMP

Executive reporting

Cloud & SaaS risk

AI tools curiosity

Communication with C-suite

Tools

N/A

Job description

Asana seeks a senior Security Risk Engineer to own and scale Asana's internal risk program, building quantitative, automated foundations for decision-making. You will partner with Legal, Privacy, Finance, and Engineering and communicate risk to executives.

The role is based in San Francisco with office-centric hybrid schedule; in-office Mon/Tue/Thu with potential WFH on Wed. Competitive base salary and equity+benefits offered.