Product Security Engineer: Build Secure AI-Ready Software

Asana; San Francisco (CA); Presencial; USD 98.000 - 148.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Health benefits

Parental leave

Descripción de la vacante

Asana is seeking a Product Security Engineer to scale secure software practices across our web, mobile, and AI-enabled surfaces. You’ll partner with product and infrastructure teams to design and ship secure features, build secure-by-default frameworks, and drive remediation of vulnerabilities through our bug bounty and internal testing programs.

You will lead security design reviews, threat modelling, and develop tooling to automate security checks, with a focus on AI-specific risks and

Formación

• 5+ years of experience in application security, product security, or software engineering with a security focus.
• Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision-making
• A pragmatic and collaborative mindset, with a passion for building defenses against real-world attacks and enabling other engineers to do their best, most secure work
• Excellent communication skills for collaborating effectively with both technical and non-technical partners
• Experience performing security design reviews and threat modelling for complex applications
• Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management
• Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces
• Strong software engineering background with experience in languages like Python, Javascript/Typescript or Scala
• Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection

Responsabilidades

• Conduct security architecture reviews, threat modeling, and code reviews for new features and services
• Develop, implement, and maintain secure-by-default frameworks and libraries that empower engineering teams to build secure systems easily
• Build and maintain automated security tooling (static and dynamic analysis rules, custom SAST/DAST checks, and automated red-teaming) to scale security coverage
• Identify and address AI-specific security risks in AI-powered features
• Triage, investigate, and drive remediation of vulnerabilities from bug bounty, internal testing, and tooling
• Influence engineering initiatives by communicating security constraints and aiding trade-off decisions
• Investigate product security incidents using logs and monitoring tools to drive resolution
• Evaluate and improve software supply chain security, including dependency management and third-party risk
• Develop and deliver training to educate engineers on secure coding best practices and emerging threats

Conocimientos

Security engineering

Threat modelling

Secure coding

Communication

Security design reviews

SAST/DAST tools

SCA familiarity

Python/JS/TypeScript/Scala

OWASP Top 10

Herramientas

SAST/DAST tooling

SCA tooling

Vulnerability management systems

AI/ML security concepts

Descripción del empleo

Asana is seeking a Product Security Engineer to scale secure software practices across our web, mobile, and AI-enabled surfaces. You’ll partner with product and infrastructure teams to design and ship secure features, build secure-by-default frameworks, and drive remediation of vulnerabilities through our bug bounty and internal testing programs.

You will lead security design reviews, threat modelling, and develop tooling to automate security checks, with a focus on AI-specific risks and