Senior Security Risk Engineer: Data-Driven Risk

Decisive Point; San Francisco (CA); Hybrid; USD 202,000 - 230,000; Full time

Benefits offered by this job

Mental health & fitness benefits

Career coaching & support

Inclusive family building benefits

Long-term savings/retirement plans

In-office culinary options

Job summary

Asana is seeking a Security Risk Engineer to own its internal risk management program end-to-end from measurement to remediation. You will design quantitative risk frameworks and build automated pipelines to surface risks for data-driven decisions.

You will partner with Legal, Privacy, Finance, and Engineering, delivering executive dashboards and KRIs to enable informed security investments. This role is based in San Francisco with an office-centric hybrid schedule.

Qualifications

• 7+ years in information security with a focus on risk management and GRC.
• Experience leading security risk programs end-to-end.
• Demonstrated ability to back risk ratings with data and numbers.

Responsibilities

• Design and mature a quantitative security risk framework and risk appetite thresholds.
• Own the central security risk register with KRIs and trend tracking.
• Automate risk identification through data pipelines and tooling integrations.
• Develop executive dashboards translating risk into business terms.
• Partner with Legal, Privacy, Finance and Engineering on risk decisions.

Skills

Security risk management

Quantitative risk methods

Automation scripting

NIST CSF / ISO 27001 / SOC 2 / FedRAMP

Cloud/SaaS risk knowledge

Executive communication

AI tools curiosity

GRC experience

Tools

Vulnerability scanners

Cloud security tooling

SIEMs

Job description

Asana is seeking a Security Risk Engineer to own its internal risk management program end-to-end from measurement to remediation. You will design quantitative risk frameworks and build automated pipelines to surface risks for data-driven decisions.

You will partner with Legal, Privacy, Finance, and Engineering, delivering executive dashboards and KRIs to enable informed security investments. This role is based in San Francisco with an office-centric hybrid schedule.