Senior Security Risk Engineer — Data-Driven Risk

Asana; San Francisco, Northern (CA, KY); Hybrid; USD 202,000 - 230,000; Full time

Benefits offered by this job

Mental health

Wellness & fitness benefits

Career coaching & support

Family building benefits

Retirement plans

In-office meals

Job summary

Asana is seeking a Security Risk Engineer in San Francisco to own the internal risk program end-to-end. You will build quantitative foundations, risk scoring, and automated pipelines to surface security risk, acting as a trusted advisor to senior leadership.

The role emphasizes hands-on automation, KRIs, and cross-functional collaboration across Legal, Privacy, Finance, and Engineering, with a hybrid in-office schedule and Fridays flexible depending on work.

Qualifications

• 7+ years in information security with a focus on risk management (GRC).
• Experience building or leading a security risk management program.
• Hands-on with quantitative risk methodologies (e.g., FAIR).
• Experience scripting or building automation to integrate tooling.
• Deep knowledge of NIST CSF, NIST SP 800-30, ISO 27001, SOC 2, FedRAMP.
• Credible risk conversations with cloud/SaaS teams and executives.
• Strong communicator for engineers and C-suite stakeholders.
• Curiosity about AI tools to boost productivity.

Responsibilities

• Own Asana's security risk management program with a quantitative framework.
• Build and maintain a living risk register with KRIs and trends.
• Automate risk identification and monitoring via data pipelines.
• Deliver executive-level dashboards comparing risk, cost, and controls.
• Partner with Legal, Privacy, Finance, and Engineering on risk decisions.

Skills

Security risk mgmt

GRC

Quant risk methods

Automation scripting

Cloud/SaaS knowledge

Executive communication

AI tools curiosity

Tools

Vulnerability scanners

SIEMs

Cloud security tooling

Third-party risk sources

Job description

Asana is seeking a Security Risk Engineer in San Francisco to own the internal risk program end-to-end. You will build quantitative foundations, risk scoring, and automated pipelines to surface security risk, acting as a trusted advisor to senior leadership.

The role emphasizes hands-on automation, KRIs, and cross-functional collaboration across Legal, Privacy, Finance, and Engineering, with a hybrid in-office schedule and Fridays flexible depending on work.