Description
At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work together effortlessly.
We're looking for a Product Security Engineer to join our Product Security team in Vancouver.
You'll be a key member of our security engineering team, partnering directly with product and infrastructure teams to ensure we design and ship secure software.
Responsibilities:
- Partner with product and engineering teams across the full software development lifecycle to ensure security is designed and built into Asana's products and platform.
- Conduct security architecture reviews, threat modeling, and code reviews for new features and services.
- Develop, implement, and maintain secure-by-default frameworks and libraries that empower engineering teams to build secure systems easily.
- Build and maintain automated security tooling (static and dynamic analysis rules, custom SAST/DAST checks, and automated red-teaming) to scale security coverage without scaling headcount.
- Identify and address AI-specific security risks such as prompt injection, insecure tool permissions, and abuse-resistant design in Asana's AI and agentic features.
- Triage, investigate, and drive remediation of vulnerabilities from our bug bounty program, internal testing, and automated security tooling.
- Influence engineering initiatives by conducting design and roadmap reviews, effectively communicating security constraints, and assisting teams in making informed trade-offs.
- Investigate product security incidents as a subject matter expert, using logs and monitoring tools to contain, analyze, and drive resolution.
- Evaluate and improve software supply chain security, including dependency management, SCA tooling, and third-party risk in the development pipeline.
- Develop and deliver training to educate engineers on secure coding best practices and emerging threats.
- Stay informed of industry trends, emerging threats, and best practices to ensure that Asana's security posture remains robust.
- Collaborate with teammates and stakeholders to develop both short-term and long-term strategies for risk management.
Requirements:
- 5+ years of experience in application security, product security, or software engineering with a security focus.
- Strong software engineering background with experience in languages like Python, Javascript/Typescript or Scala.
- Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection.
- Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces.
- Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management.
- Experience performing security design reviews and threat modeling for complex applications.
- Excellent communication skills for collaborating effectively with both technical and non-technical partners.
Benefits:
- Mental health, wellness & fitness benefits
- Career coaching & support
- Inclusive family building benefits
- Long-term savings or retirement plans
- In-office culinary options to cater to your dietary preferences
Estimated base salary range: 176,000 - 200,000 CAD