Security Risk Manager - Data-Driven & Automated

Decisive Point; San Francisco (CA); Hybrid; USD 194,000 - 220,000; Full time

Benefits offered by this job

Mental health, wellness & fitness

Career coaching & support

Inclusive family benefits

Long-term savings/retirement plans

In-office culinary options

Job summary

Asana is seeking a Security Risk Manager to own the internal security risk management program end-to-end. This senior role builds quantitative foundations, automates risk monitoring, and serves as trusted adviser to senior leadership.

Based in the San Francisco office with a hybrid schedule; in-office days Mon/Tue/Thu and optional WFH on Wed. You will partner with Legal, Privacy, Finance, and Eng to drive risk-informed decisions.

Qualifications

• 7+ years in information security with a focus on risk management and GRC.
• Experience building or leading a security risk management program.
• Hands-on with quantitative risk methodologies; back risk ratings with numbers.
• Hands-on automation to integrate security tooling and data pipelines.
• Deep knowledge of NIST CSF, NIST SP 800-30, ISO 27001, SOC 2, FedRAMP.

Responsibilities

• Own Asana's security risk management program end-to-end; design and mature a quantitative risk framework.
• Build and maintain a living risk register with KRIs and trends.
• Automate risk identification; build data pipelines from scanners, cloud tooling, SIEMs.
• Deliver executive dashboards translating risk to business terms for decision-making.
• Partner with Legal, Privacy, Finance, and Eng to influence security investments.

Skills

Security risk mgmt

GRC

Quantitative risk (FAIR)

Automation scripting

Data pipelines

Cloud/SaaS risk

Executive reporting

Tools

Vulnerability scanners

SIEMs

Cloud security tooling

Job description

Asana is seeking a Security Risk Manager to own the internal security risk management program end-to-end. This senior role builds quantitative foundations, automates risk monitoring, and serves as trusted adviser to senior leadership.

Based in the San Francisco office with a hybrid schedule; in-office days Mon/Tue/Thu and optional WFH on Wed. You will partner with Legal, Privacy, Finance, and Eng to drive risk-informed decisions.