# Product Security Engineer

**Company**: Asana
**Location**: Vancouver, BC
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: 176,000 - 200,000 CAD
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/asana/jobs/8137817?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_fc9d5da8-077

## Description

At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work together effortlessly.

We're looking for a Product Security Engineer to join our Product Security team in Vancouver.

You'll be a key member of our security engineering team, partnering directly with product and infrastructure teams to ensure we design and ship secure software.

Responsibilities:

- Partner with product and engineering teams across the full software development lifecycle to ensure security is designed and built into Asana's products and platform.

- Conduct security architecture reviews, threat modeling, and code reviews for new features and services.

- Develop, implement, and maintain secure-by-default frameworks and libraries that empower engineering teams to build secure systems easily.

- Build and maintain automated security tooling (static and dynamic analysis rules, custom SAST/DAST checks, and automated red-teaming) to scale security coverage without scaling headcount.

- Identify and address AI-specific security risks such as prompt injection, insecure tool permissions, and abuse-resistant design in Asana's AI and agentic features.

- Triage, investigate, and drive remediation of vulnerabilities from our bug bounty program, internal testing, and automated security tooling.

- Influence engineering initiatives by conducting design and roadmap reviews, effectively communicating security constraints, and assisting teams in making informed trade-offs.

- Investigate product security incidents as a subject matter expert, using logs and monitoring tools to contain, analyze, and drive resolution.

- Evaluate and improve software supply chain security, including dependency management, SCA tooling, and third-party risk in the development pipeline.

- Develop and deliver training to educate engineers on secure coding best practices and emerging threats.

- Stay informed of industry trends, emerging threats, and best practices to ensure that Asana's security posture remains robust.

- Collaborate with teammates and stakeholders to develop both short-term and long-term strategies for risk management.

Requirements:

- 5+ years of experience in application security, product security, or software engineering with a security focus.

- Strong software engineering background with experience in languages like Python, Javascript/Typescript or Scala.

- Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection.

- Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces.

- Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management.

- Experience performing security design reviews and threat modeling for complex applications.

- Excellent communication skills for collaborating effectively with both technical and non-technical partners.

Benefits:

- Mental health, wellness & fitness benefits

- Career coaching & support

- Inclusive family building benefits

- Long-term savings or retirement plans

- In-office culinary options to cater to your dietary preferences

Estimated base salary range: 176,000 - 200,000 CAD

## Skills

### Required
- Python
- Javascript/Typescript
- Scala
- OWASP Top 10
- XSS
- CSRF
- SSRF
- SQL injection
- AI/ML security
- LLM-specific risks
- SAST/DAST
- SCA
- vulnerability management

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/asana/jobs/8137817?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)