Security Risk and Compliance Lead

Responsibilities

• ▹Own and scale Asana's TPRM program with a risk-based framework
• ▹Lead vendor security assessments (SOC 2, ISO 27001, SIG, CAIQ documentation review)
• ▹Drive remediation and formal risk acceptance for assessment findings
• ▹Manage ongoing monitoring of critical and high-risk vendors
• ▹Review security provisions in vendor contracts with Legal and Privacy teams
• ▹Report on TPRM program health to leadership
• ▹Operate globally across timezones with distributed teams

Requirements

• ▹5+ years experience in third party risk management, vendor risk assessment or related infosec discipline
• ▹Strong knowledge of TPRM frameworks and standards (SIG, CAIQ, NIST SP 800-161, ISO 27001, SOC 2)
• ▹Experience conducting vendor security assessments and reviewing documentation
• ▹Solid understanding of security principles, cloud environments, data privacy and B2B SaaS compliance
• ▹Proven ability to build scalable risk management processes
• ▹Excellent communication skills translating technical risk into actionable language
• ▹Experience collaborating cross-functionally
• ▹Curiosity about AI tools

Soft skills

What we offer

• ▹Transparent, competitive compensation
• ▹Contract of Employment with optional 50% tax-deductible author's rights costs
• ▹Health insurance with dental and travel coverage (Lux Med)
• ▹Meals reimbursement on office days
• ▹Career growth budget
• ▹Home office setup budget
• ▹Gym/fitness reimbursement
• ▹Fertility healthcare and family-forming support (Carrot)
• ▹Mental health support (Modern Health)
• ▹Group life insurance
• ▹MacBook with accessories

About the company

Asana is a leading platform for human + AI collaboration used by millions of teams worldwide, with 13+ offices globally.