Security Risk Engineer

Required

• 7+ years of experience in information security with a strong focus on security risk management and GRC.
• Demonstrated experience building or leading a security risk management program — not just contributing to one.
• Hands-on experience with quantitative risk methodologies such as FAIR, risk scoring models, or statistical risk analysis. You back up risk ratings with numbers, not just color codes.
• Hands-on experience scripting or building automation to integrate security tooling, build data pipelines, or automate risk monitoring — you've built things, not just directed others to build them.Deep knowledge of security frameworks including NIST CSF, NIST SP 800-30, ISO 27001, SOC 2, and FedRAMP.
• Proven ability to develop risk metrics, KRIs, and executive-level reporting that drives decision-making.
• Strong understanding of cloud environments and SaaS architecture — enough to have credible risk conversations with technical teams.
• Excellent communicator who can translate technical risk findings for both engineering teams and C-suite stakeholders.
• Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity and decision-making.
• At Asana, we're committed to building teams that include a variety of backgrounds, perspectives, and skills. If you're interested in this role and don't meet every listed requirement, we still encourage you to apply.
• What we'll offer
• For this role, the estimated base salary range is between $158,000–$180,000 CAD. The actual base salary will vary based on various factors, including market and individual qualifications objectively assessed during the interview process.
• In addition to base salary, your compensation package may include equity and benefits. If you're interviewing for this role, speak with your Talent Acquisition Partner to learn more.