Job brief: Security Risk Engineer

What JoRoute checked · Checked by JoRoute

• Listed on Asana's own job board. JoRoute does not take listings from job ads or recruiters.
• First seen by JoRoute 2026-11-05 (2 days ago); last confirmed on the board 2026-11-05.
• The apply link opens asana.com, the address Asana's board gives for this job.
• No other listing with this title and place on this board in the last 90 days.
• No layoff notices (WARN) under this name in the state files JoRoute reads.

What the listing says · Employer's own words, not checked

• Pay: $194,000 to $220,000 a year
• Job type: Not stated
• Where: San Francisco
• Posted: 2026-06-29 · over 60 days ago

What the job asks · Employer's own words, not checked

Level: Senior. The posting asks for 7+ years of experience.

Must have

• 7+ years of experience in information security with a strong focus on security risk management and GRC.
• If you're interested in this role and don't meet every listed requirement, we still encourage you to apply.
• Asana has been named to Fortune's Best Workplaces for 7+ years and recognized by Fast Company, Forbes, and Gartner for excellence in workplace culture and innovation.

Conditions

• This role is based in our San Francisco office with an office-centric hybrid schedule.
• The standard in-office days are Monday, Tuesday, and Thursday.
• If you're interviewing for this role, your recruiter will share more about the in-office requirements
• In-office culinary options to cater to your dietary preferences

Main duties

• Own Asana's security risk management program: Design and continuously mature a quantitative risk framework — including risk scoring methodologies, likelihood…
• Build and maintain a living risk register: Own Asana's central security risk register, developing KRIs, tracking trends over time, and driving accountability…
• Deliver quantitative risk reporting: Develop executive-level dashboards that communicate security risk in business terms — probability, potential impact, cos…
• Partner cross-functionally on risk: Act as the primary security risk partner to Legal, Privacy, Finance, and Engineering.

Lines copied from the posting, not rewritten. "Preferred" or "nice to have" items are not listed as must-haves.

How it compares · Compared by JoRoute from listings

• Across Asana's 47 open listings, 28% of those with a posting date were first posted more than 60 days ago. How Asana hires

What nobody outside the employer knows · Not known

• Whether the role is already filled or on hold: employers often leave listings up.
• How many people applied, and who reads the applications.
• Where in the published range an offer would land.

Ask before you apply

1. Is this role still open, and when do you hope to fill it?
2. What are the interview steps, and when should I expect to hear back?

Share this brief

Send it to someone whose opinion you trust. They can open it without an account, and nothing about you is in the link.

Email itText it

To keep a copy, use your browser's Print or Share button.

Next steps

Full listingPractise the interview

Got a message about this job asking for money or documents? Check the message first.

Keep looking

• All 47 open Asana jobs, and how Asana hires.
• Saw a job somewhere else? Check if the employer still lists it.
• Search every job JoRoute reads from employers' own job boards. No account needed.