Security Risk and Compliance Lead

Asana is a company focused on security as foundational to its mission of helping teams work together effortlessly. The security team consists of security engineers and risk and compliance practitioners who build safeguards and collaborate to maintain trust at scale. This role is based in the Warsaw office with a hybrid schedule and involves managing the Third Party Risk Management program.

• 5+ years of experience in third-party risk management, vendor risk assessment, or related information security discipline.
• Strong knowledge of TPRM frameworks and standards including SIG, CAIQ, NIST SP 800-161, ISO 27001, SOC 2.
• Experience conducting vendor security assessments and reviewing audit reports, certifications, and penetration test summaries.
• Solid understanding of core security principles, cloud environments, data privacy, and compliance standards relevant to B2B SaaS.
• Proven ability to build and operationalize scalable risk management processes and develop effectiveness metrics.
• Excellent communication skills to translate technical risk findings for technical and non-technical audiences.
• Experience collaborating cross-functionally with Procurement, Legal, Privacy, and Engineering teams.
• Curiosity about AI tools and emerging technologies, willingness to learn and leverage them to enhance productivity and decision-making.

• Own and scale Asana’s TPRM program: design, implement, and continuously improve a risk-based framework for third-party vendors.
• Lead vendor security assessments, including reviewing SOC 2 reports, ISO 27001 certifications, and security questionnaires (SIG, CAIQ).
• Identify gaps and work with vendors to remediate findings.
• Track and manage open findings, facilitate remediation prioritization and formal risk acceptance.
• Develop and execute continuous monitoring for critical and high-risk vendors, maintain risk inventories.
• Review security provisions in vendor contracts with Legal and Privacy teams.
• Report on TPRM program health with metrics and support audit and compliance activities.
• Operate globally with coordination across timezones to support vendor assessments and risk decisions.

Employees in Poland are employed under a contract of employment. The role requires working from the Warsaw office on Monday, Tuesday, and Thursday, with hybrid work options on Wednesday and possibly Friday depending on role specifics.