Asana
Security Risk Engineer
About this role
Asana seeks a Security Risk Engineer to design and own a quantitative, automated security risk management program end-to-end. You'll build scalable systems and data pipelines that continuously measure and report on risk, enabling leadership to make confident, data-driven security investment decisions across the organization.
What you'll do
- Design and mature a quantitative risk framework with scoring methodologies, likelihood and impact modeling, and risk appetite thresholds
- Own Asana's central security risk register, developing KRIs and driving accountability for risk treatment across teams
- Build automated data pipelines and integrations to continuously surface risks from vulnerability scanners, cloud tools, SIEMs, and third-party sources
- Create executive dashboards that communicate security risk in business terms to inform investment and prioritization decisions
- Partner cross-functionally with Legal, Privacy, Finance, and Engineering to influence security strategy and build risk awareness
- Act as trusted advisor to senior leadership on security risk posture and emerging threats
What they're looking for
- Security risk management and GRC program leadership
- Quantitative risk methodologies (FAIR, risk scoring, statistical analysis)
- Scripting and automation for security tooling integration and data pipelines
- Security frameworks (NIST CSF, NIST SP 800-30, ISO 27001, SOC 2, FedRAMP)
- Risk metrics, KRIs, and executive reporting development
- Cloud environments and SaaS architecture knowledge
- Technical and business communication across teams
- Emerging technology and AI tool evaluation
Benefits
- Mental health, wellness, and fitness benefits
- Career coaching and development support
- Inclusive family building benefits
- Long-term savings or retirement plans
- In-office culinary options
- Hybrid work schedule with flexibility
Opens the official application on the employer’s site. No login required.
Asana
Asana builds work management and team collaboration software, including a product called Command for integrating with development infrastructure. The company is hiring Forward Deployed Engineers to implement customer solutions and bridge product development, Solutions Engineers to support sales and onboarding, Product Engineers to build full-stack features, and Security Engineers to manage threat response and vulnerability protection.
- Website
- asana.com
Likely interview questions
- Walk us through a quantitative risk framework you've built from scratch—what methodology did you choose and how did you drive adoption?
- Describe your experience automating security risk data collection. What tooling have you integrated and what challenges did you overcome?