Greenhouse · Posted 9 Oct 2026

full-time

Product Security Engineer

Asana · Vancouver, BC

Asana is a software company focused on team collaboration and productivity tools. As a Product Security Engineer in their Vancouver office, you will work within the product security team to integrate security best practices across the entire software development lifecycle. Your daily responsibilities will involve conducting threat modeling, performing security architecture reviews, and carrying out code reviews for new product features. A significant portion of your role will focus on building secure-by-default frameworks and automated security tooling to help engineering teams prevent vulnerabilities before they reach production. You will also be tasked with addressing emerging security challenges related to AI and agentic features, such as prompt injection and abuse-resistant design. This position requires a candidate with at least five years of experience in application or product security and a strong background in software engineering using languages like Python, JavaScript, or TypeScript. You should be comfortable collaborating with cross-functional teams to drive vulnerability remediation and improve software supply chain security. This role is ideal for a pragmatic engineer who enjoys building scalable defenses and fostering a security-first culture within a fast-paced product development environment.

product securityapplication securitythreat modelingsastdastai securitysoftware engineeringvulnerability managementsecure coding

At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work together effortlessly. Our security team protects Asana's employees, users, and customers by proactively addressing threats and fostering a culture of security throughout our product and operations. We're looking for a Product Security Engineer to join our Product Security team in Vancouver. You'll be a key member of our security engineering team, partnering directly with product and infrastructure teams to ensure we design and ship secure software. You will be instrumental in scaling our security practices by building secure-by-default frameworks, eliminating entire classes of vulnerabilities, and championing a security-first mindset across our web, mobile, and AI-powered product surfaces. This role is based in our Vancouver office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do, and your recruiter can share more about the in-office requirements. What you'll achieve Partner with product and engineering teams across the full software development lifecycle to ensure security is designed and built into Asana's products and platform. Conduct security architecture reviews, threat modeling, and code reviews for new features and services. Develop, implement, and maintain secure-by-default frameworks and libraries that empower engineering teams to build secure systems easily. Build and maintain automated security tooling (static and dynamic analysis rules, custom SAST/DAST checks, and automated red-teaming) to scale security coverage without scaling headcount. Identify and address AI-specific security risks such as prompt injection, insecure tool permissions, and abuse-resistant design in Asana's AI and agentic features. Triage, investigate, and drive remediation of vulnerabilities from our bug bounty program, internal testing, and automated security tooling. Influence engineering initiatives by conducting design and roadmap reviews, effectively communicating security constraints, and assisting teams in making informed trade-offs. Investigate product security incidents as a subject matter expert, using logs and monitoring tools to contain, analyze, and drive resolution. Evaluate and improve software supply chain security, including dependency management, SCA tooling, and third-party risk in the development pipeline. Develop and deliver training to educate engineers on secure coding best practices and emerging threats. Stay informed of industry trends, emerging threats, and best practices to ensure that Asana's security posture remains robust. Collaborate with teammates and stakeholders to develop both short-term and long-term strategies for risk management. About you Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision-making 5+ years of experience in application security, product security, or software engineering with a security focus. Strong software engineering background with experience in languages like Python, Javascript/Typescript or Scala. Deep working knowledge of the OWASP Top 10 and common web application vulnerabilities such as XSS, CSRF, SSRF, and SQL injection. Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces. Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management. Experience performing security design reviews and threat modeling for complex applications. Excellent communication skills for collaborating effectively with both technical and non-technical partners. A pragmatic and collaborative mindset, with a passion for building defenses against real-world attacks and enabling other engineers to do their best, most secure work. At Asana, we're committed to building teams that include a variety of backgrounds, perspectives, and skills, as this is critical to helping us achieve our mission. If you're interested in this role and don't meet every listed requirement, we still encourage you to apply. What we'll offer Our comprehensive compensation package plays a big part in how we recognize you for the impact you have on our path to achieving our mission. We believe that compensation should be reflective of the value you create relative to the market value of your role. To ensure pay is fair and not impacted by biases, we're committed to looking at market value which is why we check ourselves and conduct a yearly pay equity audit. For this role, the estimated base salary range is between 176,000 - 200,000 CAD. The actual base salary will vary based on various factors, including market and individual qualifications objectively assessed during the intervie

Role	Product Security Engineer
Company	Asana
Location	Vancouver, BC
Type	full-time
Compensation	Not disclosed
Posted	2026-10-09
Deadline	Rolling

Typical process for this type of role

A general guide — the exact steps for this specific listing may vary; check the original posting for details.

1ApplicationSubmit your resume through the apply link.
2ScreeningRecruiter reviews your background against the role.
3AssessmentA technical test, assignment, or coding round, depending on the role.
4Interview(s)One or more rounds with the hiring team.
5OfferOffer letter with compensation and start date.

Before you apply

0/4

Updated resume saved as a PDF
Read the full job description and eligibility criteria
Portfolio, GitHub, or work samples relevant to the role
Notice period and expected compensation, in case it comes up

About Asana

Asana is an operating system designed for human-agent teams to manage critical workflows. Founded in 2008, the platform utilizes the Asana Work Graph, a system that connects tasks, projects, goals, and dependencies to provide a shared context for both human users and AI agents. The software enables teams to collaborate within a shared space, utilizing shared memory to improve workflows over time while maintaining enterprise-grade governance, including audit trails and scoped permissions. Asana serves a wide range of organizations, including 85% of Fortune 100 companies, by providing tools for project management, compliance, portfolio monitoring, and cross-functional alignment. The platform is designed to help teams coordinate work, reduce time spent on status updates, and integrate AI agents directly into existing business processes.

All jobs and hiring details at Asana asana.com

More at Asana

Other jobs at Asana

Enterprise Account Executive (korean Market) · Singapore
Engineering Manager, Client Management · Warsaw
Senior Infrastructure Engineer (software-focused) · Warsaw
Head Of Global Campaigns · San Francisco
Commercial Counsel · San Francisco

See all 27 openings at Asana

Explore Related Placements

Asana Careers Software Engineer Jobs

← Back to jobs

// similar opportunities