Product Security Engineer

Asana, a company dedicated to helping humanity thrive by enabling teams to work together effortlessly. As a Product Security Engineer, you will be a key member of our security engineering team, partnering directly with product and infrastructure teams to ensure secure software design and development. You will conduct security architecture reviews, develop secure-by-default frameworks, and build automated security tooling. Additionally, you will address AI-specific security risks, investigate product security incidents, and evaluate software supply chain security. This role offers comprehensive health benefits, development opportunities, and a focus on career growth.

Responsibilities

• Collaborer avec les équipes de produit et d'ingénierie tout au long du cycle de vie du développement logiciel pour garantir que la sécurité est intégrée dans les produits et la plateforme d'Asana.
• Conduire des examens d'architecture de sécurité, de modélisation des menaces et de révisions de code pour les nouvelles fonctionnalités et services.
• Développer, mettre en œuvre et maintenir des cadres et des bibliothèques sécurisés par défaut qui permettent aux équipes d'ingénierie de construire facilement des systèmes sécurisés.

Requirements

• 5+ years of experience in application security, product security, or software engineering with a security focus
• Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision-making
• A pragmatic and collaborative mindset, with a passion for building defenses against real-world attacks and enabling other engineers to do their best, most secure work
• Excellent communication skills for collaborating effectively with both technical and non-technical partners
• Experience performing security design reviews and threat modeling for complex applications
• Strong software engineering background with experience in languages like Python, Javascript/Typescript or Scala
• Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection

Preferred

• Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management
• Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces

If you're interested in this role and don't meet every listed requirement, we still encourage you to apply