Product Security Engineer

Asana; San Francisco (CA); On-site; USD 98,000 - 148,000; Full time

Benefits offered by this job

Health benefits

Parental leave

Job summary

Asana is seeking a Product Security Engineer to scale secure software practices across our web, mobile, and AI-enabled surfaces. You’ll partner with product and infrastructure teams to design and ship secure features, build secure-by-default frameworks, and drive remediation of vulnerabilities through our bug bounty and internal testing programs.

You will lead security design reviews, threat modelling, and develop tooling to automate security checks, with a focus on AI-specific risks and

Qualifications

• 5+ years of experience in application security, product security, or software engineering with a security focus.
• Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision-making
• A pragmatic and collaborative mindset, with a passion for building defenses against real-world attacks and enabling other engineers to do their best, most secure work
• Excellent communication skills for collaborating effectively with both technical and non-technical partners
• Experience performing security design reviews and threat modelling for complex applications
• Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management
• Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces
• Strong software engineering background with experience in languages like Python, Javascript/Typescript or Scala
• Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection

Responsibilities

• Conduct security architecture reviews, threat modeling, and code reviews for new features and services
• Develop, implement, and maintain secure-by-default frameworks and libraries that empower engineering teams to build secure systems easily
• Build and maintain automated security tooling (static and dynamic analysis rules, custom SAST/DAST checks, and automated red-teaming) to scale security coverage
• Identify and address AI-specific security risks in AI-powered features
• Triage, investigate, and drive remediation of vulnerabilities from bug bounty, internal testing, and tooling
• Influence engineering initiatives by communicating security constraints and aiding trade-off decisions
• Investigate product security incidents using logs and monitoring tools to drive resolution
• Evaluate and improve software supply chain security, including dependency management and third-party risk
• Develop and deliver training to educate engineers on secure coding best practices and emerging threats

Skills

Security engineering

Threat modelling

Secure coding

Communication

Security design reviews

SAST/DAST tools

SCA familiarity

Python/JS/TypeScript/Scala

OWASP Top 10

Tools

SAST/DAST tooling

SCA tooling

Vulnerability management systems

AI/ML security concepts

Job description

• At Asana, security is foundational to our mission of helping humanity thrive by enabling the world’s teams to work together effortlessly. Our security team protects Asana’s employees, users, and customers by proactively addressing threats and fostering a culture of security throughout our product and operations
• We’re looking for a Product Security Engineer to join our Product Security team in Vancouver. You’ll be a key member of our security engineering team, partnering directly with product and infrastructure teams to ensure we design and ship secure software
• You will be instrumental in scaling our security practices by building secure-by-default frameworks, eliminating entire classes of vulnerabilities, and championing a security-first mindset across our web, mobile, and AI-powered product surfaces
• Partner with product and engineering teams across the full software development lifecycle to ensure security is designed and built into Asana’s products and platform
• Conduct security architecture reviews, threat modeling, and code reviews for new features and services
• Develop, implement, and maintain secure-by-default frameworks and libraries that empower engineering teams to build secure systems easily
• Build and maintain automated security tooling (static and dynamic analysis rules, custom SAST/DAST checks, and automated red-teaming) to scale security coverage without scaling headcount
• Identify and address AI-specific security risks such as prompt injection, insecure tool permissions, and abuse-resistant design in Asana’s AI and agentic features
• Triage, investigate, and drive remediation of vulnerabilities from our bug bounty program, internal testing, and automated security tooling
• Influence engineering initiatives by conducting design and roadmap reviews, effectively communicating security constraints, and assisting teams in making informed trade-offs
• Investigate product security incidents as a subject matter expert, using logs and monitoring tools to contain, analyze, and drive resolution
• Evaluate and improve software supply chain security, including dependency management, SCA tooling, and third-party risk in the development pipeline
• Develop and deliver training to educate engineers on secure coding best practices and emerging threats
• Stay informed of industry trends, emerging threats, and best practices to ensure that Asana’s security posture remains robust
• Collaborate with teammates and stakeholders to develop both short-term and long-term strategies for risk management

Benefits

• Benefits - From comprehensive health benefits including mental health programs and coaching to our in-house culinary program and supportive parental leave policies, our benefits are intentionally designed to ensure that you are energized, focused, and thriving
• Development: We know that growth isn’t always linear, so we’ll support you in achieving your personal and professional goals. You’ll have the opportunity to take on big responsibilities that impact our success as a company and challenge you in new and fulfilling ways.
• Career growth: Your growth at Asana centers on ownership, access, and choice. All employees can tap into resources that support their growth and their team’s growth in the way that works best for their unique needs.

Requirements

• 5+ years of experience in application security, product security, or software engineering with a security focus
• Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision‑making
• A pragmatic and collaborative mindset, with a passion for building defenses against real‑world attacks and enabling other engineers to do their best, most secure work
• Excellent communication skills for collaborating effectively with both technical and non‑technical partners
• Experience performing security design reviews and threat modelling for complex applications
• Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management
• Familiarity with AI/ML security concepts, including LLM‑specific risks such as prompt injection and agentic attack surfaces
• Strong software engineering background with experience in languages like Python, Javascript/Typescript or Scala
• Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection