Product Security Engineer

Asana is seeking a Product Security Engineer to join its Product Security team in Warsaw. This role is foundational to the security presence in a key engineering hub, partnering with product and infrastructure teams to ensure secure software design and delivery. The role focuses on building secure-by-default frameworks, eliminating vulnerability classes, and championing security across web, mobile, and AI-powered product surfaces.

• Partner with product and engineering teams across the full software development lifecycle to ensure security is designed and built into Asana's products and platform.
• Conduct security architecture reviews, threat modeling, and code reviews for new features and services.
• Develop, implement, and maintain secure-by-default frameworks and libraries.
• Build and maintain automated security tooling (static and dynamic analysis rules, custom SAST/DAST checks, automated red-teaming).
• Identify and address AI-specific security risks such as prompt injection, insecure tool permissions, and abuse-resistant design in AI and agentic features.
• Triage, investigate, and drive remediation of vulnerabilities from bug bounty, internal testing, and automated tooling.
• Influence engineering initiatives through design and roadmap reviews.
• Investigate product security incidents as a subject matter expert.
• Evaluate and improve software supply chain security, including dependency management, SCA tooling, and third-party risk.
• Develop and deliver training on secure coding best practices and emerging threats.
• Collaborate on short-term and long-term risk management strategies.

• 5+ years of experience in application security, product security, or software engineering with a security focus.
• Strong software engineering background with experience in languages like Python, JavaScript/TypeScript, or Scala.
• Deep working knowledge of OWASP Top 10 and common web vulnerabilities such as XSS, CSRF, SSRF, and SQL injection.
• Familiarity with AI/ML security concepts, including LLM-specific risks such as prompt injection and agentic attack surfaces.
• Experience with security tools for static/dynamic analysis (SAST/DAST), software composition analysis (SCA), and vulnerability management.
• Experience performing security design reviews and threat modeling for complex applications.
• Excellent communication skills for collaborating with technical and non-technical partners.
• Demonstrated curiosity about AI tools and emerging technologies.

Estimated base salary range: 31,000 - 36,000 PLN gross per month. Compensation includes base salary and RSUs. Benefits include health insurance with dental and travel coverage (Lux Med), breakfast and lunch catering on office days, vacation allowance, career growth budget, home office setup budget, gym/fitness card, fertility healthcare and family-forming support with Carrot, mental health support in Modern Health, group life insurance, and MacBooks with necessary accessories. Contract of Employment (UoP) is offered for employees in Poland.

This role is based in Asana's Warsaw office with an office-centric hybrid schedule. Standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays; working from home on Fridays depends on the type of work.

Apply via the provided job posting link.