SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: PLN 31,000 - 36,000 / monthly
Asana is seeking a Product Security Engineer to join its Product Security team in Warsaw. You will be a foundational member of the security presence in a key engineering hub, partnering directly with product and infrastructure teams to ensure secure software design and delivery.
Key responsibilities include:
- Partner with product and engineering teams across the full software development lifecycle to embed security into Asana's products and platform
- Conduct security architecture reviews, threat modeling, and code reviews for new features and services
- Develop, implement, and maintain secure-by-default frameworks and libraries that enable engineering teams to build secure systems
- Build and maintain automated security tooling including static and dynamic analysis rules, custom SAST/DAST checks, and automated red-teaming capabilities
- Identify and address AI-specific security risks such as prompt injection, insecure tool permissions, and abuse-resistant design in Asana's AI and agentic features
- Triage, investigate, and drive remediation of vulnerabilities from bug bounty programs, internal testing, and automated security tooling
- Influence engineering initiatives through design and roadmap reviews, communicating security constraints and assisting teams in making informed trade-offs
- Investigate product security incidents as a subject matter expert, using logs and monitoring tools to contain, analyze, and drive resolution
- Evaluate and improve software supply chain security, including dependency management, SCA tooling, and third-party risk assessment
- Develop and deliver training to educate engineers on secure coding best practices and emerging threats
- Stay informed of industry trends, emerging threats, and best practices to maintain Asana's robust security posture
- Collaborate with teammates and stakeholders to develop short-term and long-term risk management strategies
The role is based in the Warsaw office with an office-centric hybrid schedule. Standard in-office days are Monday, Tuesday, and Thursday. Most employees have the option to work from home on Wednesdays, with Friday flexibility depending on work type.
Requirements:
- 5+ years of experience in application security, product security, or software engineering with a security focus
- Strong software engineering background with experience in Python, Javascript/Typescript, or Scala
- Deep working knowledge of OWASP Top 10 and common web application vulnerabilities (XSS, CSRF, SSRF, SQL injection)
- Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces
- Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management
- Experience performing security design reviews and threat modeling for complex applications
- Excellent communication skills for collaborating with technical and non-technical partners
- Pragmatic and collaborative mindset with passion for building defenses against real-world attacks and enabling other engineers
- Demonstrated curiosity about AI tools and emerging technologies, with willingness to learn and leverage them
