Application Security Engineer

The Security team is responsible for protecting Asana’s employees, users, and customers We are a team of security engineers and risk and compliance practitioners who build innovative safeguards to ensure that our data is protected against threats and that we comply with legal, regulatory, and customer requirements

We collaborate closely with teams across the organization to foster a culture of security throughout our product and operations We’re looking for an Application Security Engineer to join our Security team in Warsaw

You’ll be a foundational member of the security presence in a key engineering hub, partnering directly with IT, infrastructure, and product teams to ensure we design and ship secure software

You will be instrumental in scaling our security practices by conducting security design reviews, threat modeling, and vulnerability assessments across our products and internal applications, eliminating entire classes of vulnerabilities, and championing a security-first mindset.

This role is based in our Warsaw office with an office-centric hybrid schedule The standard in-office days are Monday, Tuesday, and Thursday Most Asanas have the option to work from home on Wednesdays

Working from home on Fridays depends on the type of work you do, and your recruiter can share more about the in-office requirements We offer a Contract of Employment (UoP) for our employees in Poland.

What you’ll achieve

• Conduct security architecture reviews and threat modeling for new features and services across our product and internal applications, identifying risks early and influencing secure design decisions.
• Perform vulnerability assessments of software and systems, using a range of assessment methodologies to surface and prioritize security weaknesses across our product surface.
• Triage, investigate, and drive remediation of vulnerabilities from our bug bounty program and automated security tooling, ensuring issues are tracked and resolved within defined SLAs.
• Influence engineering initiatives by conducting design and roadmap reviews, effectively communicating security constraints, and assisting teams in making informed trade-offs.
• Investigate product security incidents as a subject matter expert, using logs and monitoring tools to assess scope, impact, and root cause.
• Develop and deliver training to educate engineers on secure coding best practices, threat modeling techniques, and emerging threats.
• Stay informed of industry trends, emerging threats, and best practices to ensure that Asanas security posture remains robust and ahead of the threat landscape.
• Collaborate with teammates and stakeholders to develop both short-term and long-term strategies for risk management and security program maturity.
• Join a collaborative Security team composed of specialists in product, application, software engineering, infrastructure and detection and response, all working togethe