Product Security Engineer

Asana is a company committed to building secure software products and enabling secure collaboration across teams. The role is based in the Warsaw office, working in a hybrid model, joining the Product Security team to protect Asana's employees, users, and customers by proactively addressing threats and fostering a culture of security.

• 5+ years experience in application security, product security, or security-focused software engineering.
• Strong software engineering background in Python, JavaScript, TypeScript, or Scala.
• Deep knowledge of OWASP Top 10 and web vulnerabilities including XSS, CSRF, SSRF, and SQL injection.
• Familiarity with AI/ML security concepts including LLM-specific risks like prompt injection and agentic attack surfaces.
• Experience with static/dynamic analysis tools (SAST, DAST), software composition analysis (SCA), and vulnerability management.
• Experience performing security design reviews and threat modeling for complex applications.
• Excellent communication skills for collaboration with technical and non-technical partners.
• Pragmatic and collaborative mindset focused on building defenses against real-world attacks.
• Demonstrated curiosity about AI tools and emerging technologies with willingness to learn and leverage them.

• Partner with product and engineering teams across the software development lifecycle to ensure built-in security.
• Conduct security architecture reviews, threat modeling, and code reviews for new features and services.
• Develop, implement, and maintain secure-by-default frameworks and libraries.
• Build and maintain automated security tooling including static and dynamic analysis rules and custom SAST/DAST checks.
• Identify and address AI-specific security risks such as prompt injection and insecure tool permissions.
• Triage, investigate, and drive remediation of vulnerabilities from bug bounty programs and automated security tools.
• Influence engineering initiatives by conducting design and roadmap reviews and communicating security constraints.
• Investigate product security incidents as a subject matter expert, using logs and monitoring tools.
• Evaluate and improve software supply chain security including dependency management and third-party risk.
• Develop and deliver training to educate engineers on secure coding best practices and emerging threats.
• Stay informed of industry trends, emerging threats, and best practices to maintain Asana's security posture.
• Collaborate to develop short-term and long-term risk management strategies.

The position is based in Warsaw with a hybrid office-centric schedule. Standard in-office days are Monday, Tuesday, and Thursday with options for some work-from-home days based on role and recruiter input.