Product Security Engineer

Vancouver, BC · San Francisco · 5+ years experience · Hybrid · Posted Oct 9, 2026

At a glance

Asana is a leading platform for human + AI collaboration. Millions of teams around the world rely on Asana to achieve their most important goals, faster. Asana has been named to Fortune's Best Workplaces for 7+ years and recognized by Fast Company, Forbes, and Gartner for excellence in workplace culture and innovation. We offer an exceptional office-centric culture while adopting the best elements of hybrid models to ensure that every one of our global team members can work together effortlessly. With 13+ offices all over the world, we are always looking for individuals who care about building technology that drives positive change in the world and a culture where everyone feels that they belong.
We believe in supporting people to do their best work and thrive. Our goal is to ensure that Asana upholds an environment where all people feel that they are respected and valued, whether they are applying for an open position or working at the company. We provide equal employment opportunities to all applicants without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by law.
Join Asana’s Talent Network to stay up to date on job opportunities and life at Asana.

The Product Security Engineer will partner with product and infrastructure teams to design and ship secure software at Asana.
This role focuses on scaling security practices through secure-by-default frameworks, vulnerability mitigation, and addressing security risks across web, mobile, and AI-powered product surfaces.

Partner with product and engineering teams across the full software development lifecycle to ensure security is designed into products.
Conduct security architecture reviews, threat modeling, and code reviews for new features and services.
Develop, implement, and maintain secure-by-default frameworks and libraries.
Build and maintain automated security tooling including SAST/DAST rules and automated red-teaming.
Identify and address AI-specific security risks such as prompt injection and insecure tool permissions.
Triage, investigate, and drive remediation of vulnerabilities from bug bounty programs and internal testing.
Influence engineering initiatives by conducting design and roadmap reviews.
Investigate product security incidents as a subject matter expert.
Evaluate and improve software supply chain security, including dependency management and SCA tooling.
Develop and deliver training to educate engineers on secure coding best practices.

5+ years of experience in application security, product security, or software engineering with a security focus.
Strong software engineering background with experience in Python, Javascript/Typescript, or Scala.
Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities.
Familiarity with AI/ML security concepts, including LLM-specific risks.
Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management.
Experience performing security design reviews and threat modeling for complex applications.
Excellent communication skills for collaborating with technical and non-technical partners.