The opportunity
At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work together effortlessly. Our security team protects Asana's employees, users, and customers by proactively addressing threats and fostering a culture of security throughout our product and operations.
What you'll do
Partner with product and engineering teams across the full software: development lifecycle to ensure security is designed and built into Asana's products and platform.
Conduct security architecture reviews, threat modeling, and code reviews for new features and services.
Develop, implement, and maintain secure-by-default frameworks and libraries: that empower engineering teams to build secure systems easily.
Build and maintain automated security tooling (static and dynamic analysis: rules, custom SAST/DAST checks, and automated red-teaming) to scale security coverage without scaling headcount.
Identify and address AI-specific security risks such as prompt injection,: insecure tool permissions, and abuse-resistant design in Asana's AI and agentic features.
Triage, investigate, and drive remediation of vulnerabilities from our bug: bounty program, internal testing, and automated security tooling.
What they're looking for
- Influence engineering initiatives by conducting design and roadmap reviews,: effectively communicating security constraints, and assisting teams in making informed trade-offs.
- Investigate product security incidents as a subject matter expert, using logs: and monitoring tools to contain, analyze, and drive resolution.
- Evaluate and improve software supply chain security, including dependency: management, SCA tooling, and third-party risk in the development pipeline.
- Develop and deliver training to educate engineers on secure coding best practices and emerging threats.
