SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: CAD 176,000 - 200,000 / annual
Asana is seeking a Product Security Engineer to join its Product Security team in Vancouver. This is a hybrid role with an office-centric schedule (in-office Monday, Tuesday, Thursday; Wednesday work-from-home available; Friday flexibility depends on work type).
You will partner directly with product and infrastructure teams throughout the software development lifecycle to ensure security is designed and built into Asana's products and platform. Key responsibilities include:
• Conduct security architecture reviews, threat modeling, and code reviews for new features and services
• Develop, implement, and maintain secure-by-default frameworks and libraries that empower engineering teams to build secure systems
• Build and maintain automated security tooling including static and dynamic analysis rules, custom SAST/DAST checks, and automated red-teaming to scale security coverage
• Identify and address AI-specific security risks such as prompt injection, insecure tool permissions, and abuse-resistant design in Asana's AI and agentic features
• Triage, investigate, and drive remediation of vulnerabilities from bug bounty programs, internal testing, and automated security tooling
• Influence engineering initiatives by conducting design and roadmap reviews, communicating security constraints, and helping teams make informed trade-offs
• Investigate product security incidents as a subject matter expert, using logs and monitoring tools to contain, analyze, and drive resolution
• Evaluate and improve software supply chain security, including dependency management, SCA tooling, and third-party risk in the development pipeline
• Develop and deliver training to educate engineers on secure coding best practices and emerging threats
• Stay informed of industry trends, emerging threats, and best practices to ensure Asana's security posture remains robust
• Collaborate with teammates and stakeholders to develop both short-term and long-term strategies for risk management
Asana is a leading platform for human + AI collaboration used by millions of teams worldwide. The company has been recognized by Fortune, Fast Company, Forbes, and Gartner for workplace culture and innovation, with 13+ offices globally.
REQUIREMENTS:
• 5+ years of experience in application security, product security, or software engineering with a security focus
• Strong software engineering background with experience in languages such as Python, Javascript/Typescript, or Scala
• Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities (XSS, CSRF, SSRF, SQL injection)
• Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces
• Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management
• Experience performing security design reviews and threat modeling for complex applications
• Excellent communication skills for collaborating effectively with both technical and non-technical partners
• A pragmatic and collaborative mindset with a passion for building defenses against real-world attacks and enabling other engineers
• Demonstrates curiosity about AI tools and emerging technologies, with willingness to learn and leverage them to enhance productivity and decision-making
