# Third Party Risk Management Lead

**Company**: Asana
**Location**: Vancouver, BC
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: $123,000-140,000 CAD
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/asana/jobs/7821585?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_af4c07a7-c93

## Description

At Asana, security is foundational to our mission of helping teams work together effortlessly.

Our security team protects Asana’s employees, users, and customers by proactively addressing threats, ensuring compliance with legal and regulatory requirements, and fostering a culture of security throughout our product and operations.

As the Third Party Risk Management Lead, you will be responsible for building and running Asana’s Third Party Risk Management (TPRM) program.

**Key Responsibilities:**

- Own and scale Asana’s TPRM program: Design, implement, and continuously improve a risk-based framework for assessing and managing third-party vendors and service providers.

- Lead vendor security assessments: Conduct and oversee security due diligence for new and existing vendors.

- Drive remediation and risk acceptance: Track and manage open findings from vendor assessments.

- Manage ongoing third-party monitoring: Develop and execute a continuous monitoring strategy for critical and high-risk vendors.

- Review security provisions in vendor contracts: Collaborate with Legal and Privacy teams to assess and negotiate security-related clauses.

- Report on TPRM program health: Develop metrics and reporting to communicate the state of third-party risk to senior leadership.

**Requirements:**

- 5+ years of experience in third-party risk management, vendor risk assessment, or a related information security discipline.

- Strong knowledge of TPRM frameworks and standards, including SIG, CAIQ, NIST SP 800-161, ISO 27001, and SOC 2.

- Experience conducting vendor security assessments and reviewing third-party security documentation.

- Solid understanding of core security principles, cloud environments, data privacy, and compliance standards.

- Proven ability to build and operationalize scalable risk management processes.

- Excellent communication skills, with the ability to translate technical risk findings into clear, actionable language.

**What We Offer:**

- Estimated base salary range: $123,000-140,000 CAD.

- Comprehensive compensation package, including equity, sales incentive pay, and benefits.

- Mental health, wellness & fitness benefits.

- Career coaching & support.

- Inclusive family building benefits.

- Long-term savings or retirement plans.

- In-office culinary options.

## Skills

### Required
- TPRM
- vendor risk assessment
- information security
- SIG
- CAIQ
- NIST SP 800-161
- ISO 27001
- SOC 2
- cloud environments
- data privacy
- compliance standards

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/asana/jobs/7821585?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)