Product Security Engineer

Asana is a leading platform for human + AI collaboration with 13+ offices globally. It is recognized for excellence in workplace culture and innovation, serving millions of teams worldwide. The role is based in the Warsaw office and contributes to the product security team focused on building secure software.

• 5+ years in application/product security or security-focused software engineering.
• Strong coding experience in Python, JavaScript, TypeScript, or Scala.
• Deep knowledge of OWASP Top 10 and web vulnerabilities (XSS, CSRF, SSRF, SQL injection).
• Familiarity with AI/ML security and risks like prompt injection.
• Experience with SAST/DAST tools, software composition analysis, and vulnerability management.
• Skilled in security design reviews and threat modeling.
• Excellent communication skills.
• Pragmatic, collaborative mindset focused on defense against attacks.
• Demonstrated curiosity about AI tools and emerging technologies.

• Partner with product and engineering teams to integrate security into products and platform.
• Conduct security architecture reviews, threat modeling, and code reviews.
• Develop and maintain secure-by-default frameworks and libraries.
• Build automated security tooling including static and dynamic analysis and automated red-teaming.
• Identify and address AI-specific security risks such as prompt injection and insecure permissions.
• Triage and remediate vulnerabilities from bug bounty, testing, and automation.
• Influence engineering initiatives via design and roadmap reviews.
• Investigate product security incidents using logs and monitoring tools.
• Improve software supply chain security including dependency management and SCA tooling.
• Deliver training on secure coding and emerging threats.
• Stay informed on industry trends, threats, and best practices.
• Collaborate on strategies for risk management.

Please be informed that the data controller is Asana, 633 Folsom Street, Suite 100, San Francisco, California 94107, US. Personal data is processed for recruitment purposes with rights to access, rectify, erase, restrict, object, and portability. Providing mandatory data is required, refusal may prevent participation in recruitment. Consent to personal data processing can be withdrawn anytime.