Security Risk and Compliance Lead
Warsaw, Poland · Posted 4 months agoDescription
At Asana, security is foundational to our mission of helping teams work together effortlessly. Our security team protects Asana’s employees, users, and customers by proactively addressing threats, ensuring compliance with legal and regulatory requirements, and fostering a culture of security throughout our product and operations. We are a team of security engineers and risk and compliance practitioners who build innovative safeguards and collaborate across the organization to build and maintain trust at scale.
As the Third Party Risk Management Lead, you will be responsible for building and running Asana’s Third Party Risk Management (TPRM) program. You will own the end-to-end lifecycle of vendor security risk — from initial due diligence and risk tiering through ongoing monitoring and remediation. You will work closely with Procurement, Legal, Privacy, and Engineering teams to ensure that our third-party relationships are effectively assessed, tracked, and managed.
This role is based in our Warsaw office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do, and your recruiter can share more about the in-office requirements.
Our employees in Poland are employed under a contract of employment.
What you’ll achieve
- Own and scale Asana’s TPRM program: Design, implement, and continuously improve a risk-based framework for assessing and managing third-party vendors and service providers. Establish risk tiering criteria, assessment workflows, and governance processes that scale with business growth.
- Lead vendor security assessments: Conduct and oversee security due diligence for new and existing vendors, including reviewing SOC 2 reports, ISO 27001 certifications, security questionnaires (SIG, CAIQ), and other relevant documentation. Identify gaps and work with vendors to remediate findings.
- Drive remediation and risk acceptance: Track and manage open findings from vendor assessments, work with internal stakeholders to prioritize remediation, and facilitate formal risk acceptance processes where appropriate. Ensure findings are documented and resolved in a timely manner.
- Manage ongoing third-party monitoring: Develop and execute a continuous monitoring strategy for critical and high-risk vendors, including periodic reassessments, breach notifications, and security posture updates. Maintain an accurate and up-to-date vendor risk inventory.
- Review security provisions in vendor contracts: Collaborate with Legal and Privacy teams to assess and negotiate security-related clauses in vendor agreements, data processing addenda, and subprocessor agreements, ensuring alignment with Asana’s policies and obligations.
- Report on TPRM program health: Develop metrics and reporting to communicate the state of third-party risk to senior leadership and relevant stakeholders. Support audit and compliance activities by providing evidence of TPRM program effectiveness, including for SOC 2, ISO 27001, and customer audits.
- Operate globally: Work with a global team to ensure appropriate coverage and coordination across timezones, supporting vendor assessments and risk decisions that span multiple regions.
About you
- 5+ years of experience in third-party risk management, vendor risk assessment, or a related information security discipline.
- Strong knowledge of TPRM frameworks and standards, including SIG, CAIQ, NIST SP 800-161, ISO 27001, and SOC 2.
- Experience conducting vendor security assessments and reviewing third-party security documentation (audit reports, certifications, penetration test summaries, etc.).
- Solid understanding of core security principles, cloud environments, data privacy, and compliance standards relevant to B2B SaaS organizations.
- Proven ability to build and operationalize scalable risk management processes and develop metrics for tracking program effectiveness.
- Excellent communication skills, with the ability to translate technical risk findings into clear, actionable language for both technical and non-technical audiences.
- Experience collaborating cross-functionally with Procurement, Legal, Privacy, and Engineering teams.
- Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision-making.
At Asana, we're committed to building teams that include a variety of backgrounds, perspectives, and skills, as this is critical to helping us achieve our mission. If you're interested in this role and don't meet every listed requirement, we still encourage you to apply.
What we’ll offer
- Generous, transparent and fair compensation system
- Contract of Employment (and the option of 50% tax deductible costs for author’s rights usage in respect of applicable roles )
- Health insurance with dental and travel coverage (Lux Med)
- Meals reimbursement on the days that you work from the office
- Career growth budget
- Home office setup budget
- Gym/Fitness reimbursement
- Fertility healthcare and family-forming support with Carrot
- Mental Health Support in Modern Health
- Group life insurance
- MacBooks with all necessary accessories
For this role, the estimated base salary range is between 22,750 - 27,250 PLN gross per month (subject to all taxes and necessary deductions). The actual base salary will vary based on various factors, including market and individual qualifications objectively assessed during the interview process. The listed range above is a guideline, and the base salary range for this role may be modified.
In addition to base salary, your compensation package may include additional components such as equity and sales incentive pay (for most sales roles), and benefits. If you're interviewing for this role, speak with your Talent Acquisition Partner to learn more about the total compensation and benefits for this role.
#LI-Hybrid
About us
Asana is a leading platform for human + AI collaboration. Millions of teams around the world rely on Asana to achieve their most important goals, faster. Asana has been named to Fortune's Best Workplaces for 7+ years and recognized by Fast Company, Forbes, and Gartner for excellence in workplace culture and innovation. We offer an exceptional office-centric culture while adopting the best elements of hybrid models to ensure that every one of our global team members can work together effortlessly. With 13+ offices all over the world, we are always looking for individuals who care about building technology that drives positive change in the world and a culture where everyone feels that they belong.
Join Asana’s Talent Network to stay up to date on job opportunities and life at Asana.
Similar jobs
Est. 420,000 PLN
At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work together effortlessly. Our security team protects Asana's employees, users, and customers by proactively…
Est. 403,800 PLN
At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work together effortlessly. The security team protects Asana's employees, users, and customers by proactively…
Est. 204,000 PLN
We're looking for a Program Manager to join our R&D Operations team in Warsaw and own the end-to-end scheduling and coordination of our R&D Onboarding program - while driving additional operational programs that…
Est. 420,000 PLN
The Product Management team drives Asana’s product strategy and execution, translating customer needs and opportunities into a compelling roadmap and working cross-functionally to deliver impactful solutions for team pro…
Est. 522,000 PLN
The Security team is responsible for protecting Asana’s employees, users, and customers. We are a team of security engineers and risk and compliance practitioners who build innovative safeguards to ensure that our data i…
Est. 312,000 PLN
The Product team builds features end-to-end. From designing our data models to implementing the subtle interaction behaviors that differentiate good software from great software. We work closely with UI designers and are…
Est. 144,000 PLN
The Product team builds features end-to-end. From designing our data models to implementing the subtle interaction behaviors that differentiate good software from great software. We work closely with UI designers and are…
Est. 348,000 PLN
Data Scientist The Data Science team helps us fulfill our mission by informing strategy, defining success metrics, and identifying new ways to deliver user value. Data scientists are at the crux of deepening our understa…
Est. 408,000 PLN
Command by Asana is a new product for R&D teams to keep delivery on track as scope shifts, give managers visibility into progress, and enable humans and agents to work from cleaner context and ship with fewer iterati…
Est. 522,000 PLN
We're looking for an Engineering Manager who combines strong technical judgment with people leadership to help build the systems and team practices that keep Asana resilient at scale. This role is a great fit for someone…
Est. 432,000 PLN
The Product team builds features end-to-end. From designing our data models to implementing the subtle interaction behaviors that differentiate good software from great software. We work closely with UI designers and are…
Est. 420,000 PLN
We're looking for a Senior Infrastructure Engineer who brings strong software engineering skills and a deep understanding of production systems. This role is a good fit for someone who enjoys building systems that make i…
Est. 384,000 PLN
Asana’s rapid growth brings new challenges in keeping our systems fast, reliable, and resilient. As our product evolves, we’re making a major investment in reliability – and building a brand new SRE team in Warsaw is a k…
Est. 348,000 PLN
We're looking for a Tech Lead to own technical direction for Asana's Platform Reliability Engineering team. This role is for someone who thrives as a technical leader without needing to take on people management. At Asan…
Est. 403,800 PLN
The AI Retrieval team powers the intelligence behind Asana's AI features by finding relevant work graph content and delivering it to LLM context windows. Our work enables AI features that truly understand your work—both…
Est. 312,000 PLN
The Data Science & Analytics team at Asana is how the company turns data into decisions — defining the questions that matter, surfacing the answers, and making sure insight is at the center of every critical product…
Est. 312,000 PLN
As a Salesforce Technical Architect on the Enterprise Technology Apps RevTech team in Warsaw, you will support insights with data and the technical systems that give our teams leverage to achieve their objectives. Workin…
Est. 583,200 PLN
The AI Retrieval team powers the intelligence behind Asana's AI features by finding relevant work graph content and delivering it to LLM context windows. Our work enables AI features that truly understand your work—both…
Est. 312,000 PLN
We're looking for a Product Designer who is excited by our mission of designing the future of teamwork. With millions of teams using Asana across the globe, our work has only just begun. Join us on a journey of driving c…
Est. 552,000 PLN
Asana's Data Science team helps us fulfill our mission by informing strategy, defining success metrics, and identifying new ways to deliver user value. Data scientists are at the crux of deepening our understanding of th…
Est. 384,000 PLN
We're looking for a Senior Platform Reliability Engineer who brings strong software engineering skills and a deep understanding of system behavior under load and stress. This role is a good fit for someone who wants to o…
Est. 30,000 PLN
The Product Management team drives Asana’s product strategy and execution, translating customer needs and opportunities into a compelling roadmap and working cross-functionally to deliver impactful solutions for team pro…
Est. 312,000 PLN
The Data Engineering team’s mission is to ensure high-quality data to enable data-informed decision-making across Asana. You will build data artifacts that are leveraged by a wide range of stakeholders in the marketing d…
Est. 282,312 PLN
The Product Management team drives Asana’s product strategy and execution, translating customer needs and opportunities into a compelling roadmap and working cross-functionally to deliver impactful solutions for team pro…
Est. 276,960 PLN
Asana is looking for an experienced Audio Visual Engineer to join our IT Team and help manage AV and event operations across our worldwide offices. Based in our Warsaw office, you will primarily support our conference ro…
Est. 112,000 EUR
We're looking for a senior technical consultant who thrives across the full arc of a complex technical engagement, from pre-sales scoping and architecture through hands-on delivery and handoff. As the sole Technical Serv…
Est. 207,000 USD
At Asana, security is foundational to our mission of helping teams work together effortlessly. Our Security organization protects Asana’s employees, users, and customers by proactively addressing threats, enabling secure…
Est. 207,000 USD
At Asana, security is foundational to our mission of helping teams work together effortlessly. Our security team protects Asana's employees, users, and customers by proactively addressing threats, ensuring compliance, an…
Est. 170,000 EUR
We are entering a new era of work — one where AI agents collaborate alongside people to plan, act, and deliver outcomes at a scale and speed that wasn't possible before. At Asana, we call this Agentic Work Management: th…
Est. 282,000 USD
At Asana, security is foundational to our mission of helping teams work together effortlessly. Our Security organization protects Asana’s employees, users, and customers by proactively addressing threats, enabling secure…