Security Risk Manager

Asana is seeking a Security Risk Manager to own its internal security risk management program end-to-end. This senior role focuses on building quantitative and automated foundations for risk measurement, moving beyond frameworks and checklists. The role is based in San Francisco with a hybrid schedule (Mon, Tue, Thu in office).

• Design and mature a quantitative risk framework, including risk scoring, likelihood/impact modeling, and risk appetite thresholds.
• Own the central security risk register, developing KRIs and driving accountability for risk treatment.
• Automate risk identification and monitoring via data pipelines and integrations with vulnerability scanners, cloud security tooling, SIEMs, and third-party sources.
• Deliver executive-level dashboards communicating risk in business terms (probability, impact, cost of control vs. breach).
• Partner with Legal, Privacy, Finance, and Engineering to influence security investment decisions.

• 7+ years in information security with focus on risk management and GRC.
• Experience building/leading a security risk program.
• Hands-on with quantitative risk methodologies (FAIR, risk scoring, statistical analysis).
• Scripting/automation experience for security tooling and data pipelines.
• Deep knowledge of NIST CSF, NIST SP 800-30, ISO 27001, SOC 2, FedRAMP.
• Strong understanding of cloud environments and SaaS architecture.
• Excellent communication for technical and C-suite audiences.
• Curiosity about AI tools and emerging technologies.

Base salary range: $194,000–$220,000. In addition to base salary, the compensation package may include equity and benefits.

Equity, retirement plans, mental health/wellness/fitness benefits, career coaching, inclusive family building benefits, in-office culinary options.

Apply via the Asana careers page.