Product Security Engineer

Our Security team keeps Asana's employees, users, and customers safe, by proactively addressing threats and fostering a culture of security throughout our product and operations. We are looking for a savvy Security Engineer to join our Blue Team. You will be a foundational member of the security presence in our Warsaw innovation hub, partnering directly with IT, infrastructure, and product teams to ensure we have robust detection and response capabilities. Detection and response here leans on engineering practice. We are investing in automation and detection-as-code to cut down on manual triage, and we are looking for someone comfortable writing and reviewing code as part of that work. This role is based in our Vancouver office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do and the teams with which you partner. If you're interviewing for this role, your recruiter will share more about the in-office requirements. What you'll achieve: Lead detection, analysis, and response across our cloud and SaaS environments, identity providers, endpoints, and the software supply chain , ensuring timely and effective remediation of security incidents. Investigate and remediate security incidents across cloud infrastructure (AWS/GCP/Azure), identity providers (e.g., Okta), and SaaS environments. Investigate and contain software supply chain and CI/CD incidents , from unauthorized changes in build environments to suspect third-party dependencies (e.g., npm, PyPI). Help build and maintain our detection-as-code infrastructure (e.g., Panther), SOAR automation, and response playbooks, treating detection logic as tested, version-controlled production code. Utilize and optimize security tools such as Panther for SIEM, CrowdStrike for endpoint detection and response, and other security platforms. Cond

At Asana, security is foundational to our mission of helping teams work together effortlessly. Our security team protects Asana’s employees, users, and customers by proactively addressing threats, ensuring compliance with legal and regulatory requirements, and fostering a culture of security throughout our product and operations. We are a team of security engineers and risk and compliance practitioners who build innovative safeguards and collaborate across the organization to build and maintain trust at scale. As the Third Party Risk Management Lead, you will be responsible for building and running Asana’s Third Party Risk Management (TPRM) program. You will own the end-to-end lifecycle of vendor security risk — from initial due diligence and risk tiering through ongoing monitoring and remediation. You will work closely with Procurement, Legal, Privacy, and Engineering teams to ensure that our third-party relationships are effectively assessed, tracked, and managed. This role is based in our Vancouver office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do and the teams with which you partner. If you're interviewing for this role, your recruiter will share more about the in-office requirements. What you’ll achieve Own and scale Asana’s TPRM program: Design, implement, and continuously improve a risk-based framework for assessing and managing third-party vendors and service providers. Establish risk tiering criteria, assessment workflows, and governance processes that scale with business growth. Lead vendor security assessments: Conduct and oversee security due diligence for new and existing vendors, including reviewing SOC 2 reports, ISO 27001 certifications, security questionnaires (SIG, CAIQ), and other relevant documentation. Identify gaps and work with vendors to remediate findings. Dri

Why join us Brex is the intelligent finance platform that enables companies to spend smarter and move faster in more than 200 markets. By combining global corporate cards and banking with intuitive spend management, bill pay, and travel software, Brex enables founders and finance teams to accelerate operations, gain real-time visibility, and control spend effortlessly. Brex’s AI-native automation and world-class service eliminate manual expense and accounting tasks for customers so they can focus on what matters most. Tens of thousands of the world's best companies run on Brex, including DoorDash, Coinbase, Robinhood, Zoom, Plaid, Reddit, and SeatGeek. Working at Brex allows you to push your limits, challenge the status quo, and collaborate with some of the brightest minds in the industry. We’re committed to building a diverse team and inclusive culture and believe your potential should only be limited by how big you can dream. We make this a reality by empowering you with the tools, resources, and support you need to grow your career. Engineering at Brex Engineering at Brex is about building systems that scale with speed and intention. Our teams span Software, Data, Security, and IT, and operate with high autonomy and deep collaboration. We tackle hard technical problems, own our outcomes, and push for excellence at every level — from architecture to deployment. It’s an environment where engineering is a craft, and builders become leaders. Where you’ll work This role will be based in our Vancouver Office. We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home. We currently require a minimum of three coordinated days in the office per week, Monday, Wednesday and Thursday. As a perk, we also have up to four weeks per year of fully remote work! What you’ll do This opportunity is on our Product Data Platform (PDP) team, which builds and operates the high-performance data, q

At Asana, security is foundational to our mission of helping teams work together effortlessly. Our Security organization protects Asana’s employees, users, and customers by proactively addressing threats, enabling secure product development, and embedding security into the fabric of how we operate. We partner closely with Engineering, Product, IT, Legal, and Compliance to build and maintain trust at scale. As a Security Technical Program Manager, you'll be the connective tissue across the entire Security organization, driving the strategy, programs, and operational rhythms that make the team highly effective and externally visible. This is a high-impact, high-autonomy role. You'll define how Security as a function operates: how it plans, how it measures itself, how it communicates progress, and how it executes on its biggest bets. You won't just run programs, you'll shape the operating model that makes all programs run better. This role is based in our Vancouver office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do and the teams with which you partner. If you're interviewing for this role, your recruiter will share more about the in-office requirements. What you’ll achieve Lead high-impact, cross-functional special projects that span organizational boundaries, from standing up new security capabilities and maturity programs to company-wide strategic initiatives Own the Security organization's annual and quarterly planning cycles, translating multi-year security strategy into a prioritized, executable roadmap Drive the prioritization and communication of security asks across stakeholders, building a unified framework that influences how partner teams plan and prioritize security work Define and own the Security team's KPI framework, covering risk posture, program health, and strategic goal

Here's a summary of the role: Identity infrastructure is not glamourware . It doesn't get standing ovations at company all-hands. But it is the thing every product in the portfolio depends on, and when it breaks, everyone knows. If you're the kind of PM who finds that genuinely interesting, read on. This role is for someone who has lived inside SAML flows, argued over PKCE token lifetimes, and knows exactly why SSO bypass lists are a necessary compromise. You'll own the authentication platform that thousands of enterprise customers trust, and you'll shape it alongside engineers who go deep. No surface-level roadmap ownership here. Here's a breakdown of what you'll do (not all of it, just the important stuff) Own the product strategy and roadmap for core authentication flows: SAML 2.0, OIDC/OAuth 2.0 with PKCE, MFA enforcement, token lifecycle management, and multi-IdP federation. Make product decisions that sit at the intersection of system design, security architecture, and developer experience, working directly with senior engineers on protocol choices and infrastructure trade-offs. Drive adoption of platform identity capabilities across internal engineering teams through influence, moving products toward modern API patterns and away from legacy integration surfaces. Use AI coding tools (Claude Code, Cursor, or similar) to prototype ideas and validate concepts before you pitch them; this is expected, not optional. Track the IAM standards landscape, including passkeys, FIDO2, SCIM, zero-trust, and verifiable credentials, and use that knowledge to sharpen product direction. Translate complex authentication concepts (JWT structures, SAML assertions, PKCE handshakes) into clear specs, user stories, and prioritized backlogs for audiences from engineers to executives. These are the essentials you'll ne

Why join us Brex is the intelligent finance platform that enables companies to spend smarter and move faster in more than 200 markets. By combining global corporate cards and banking with intuitive spend management, bill pay, and travel software, Brex enables founders and finance teams to accelerate operations, gain real-time visibility, and control spend effortlessly. Brex’s AI-native automation and world-class service eliminate manual expense and accounting tasks for customers so they can focus on what matters most. Tens of thousands of the world's best companies run on Brex, including DoorDash, Coinbase, Robinhood, Zoom, Plaid, Reddit, and SeatGeek. Working at Brex allows you to push your limits, challenge the status quo, and collaborate with some of the brightest minds in the industry. We’re committed to building a diverse team and inclusive culture and believe your potential should only be limited by how big you can dream. We make this a reality by empowering you with the tools, resources, and support you need to grow your career. Engineering at Brex Engineering at Brex is about building systems that scale with speed and intention. Our teams span Software, Data, Security, and IT, and operate with high autonomy and deep collaboration. We tackle hard technical problems, own our outcomes, and push for excellence at every level — from architecture to deployment. It’s an environment where engineering is a craft, and builders become leaders. What you’ll do As a Staff Software Engineer in Banking, you will help shape the technical direction of one of Brex’s most strategic and complex product areas. The Banking org is both a product and platform org, it owns the Brex Business Account product and AP offerings like Bill Pay and Vendors, and the underlying money movement platform and partner integrations that power those experiences. In this role, you’ll work across customer-facing product surfaces and core financial infrastructure, driving architecture, reliability, and