Engineering Manager, Threat Response

<p>At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work&nbsp;together effortlessly. Our security team protects Asana's employees, users, and customers by proactively&nbsp;addressing threats and fostering a culture of security throughout our product and operations. We are looking for a&nbsp;Manager of Threat Response to lead and grow our team of Security Threat Response Engineers in Warsaw. This is&nbsp;a player-manager role for a deeply technical security professional who is as comfortable handling a complex&nbsp;incident investigation as they are building the processes, people, and partnerships that make world-class incident&nbsp;response sustainable at scale. You will own the strategy and execution of Asana's Security Incident Response&nbsp;programme, drive the maturity of our detection and response capabilities, and establish a hybrid layered SOC&nbsp;model in partnership with a Managed Security Service Provider (MSSP).</p> <p>This role is based in our Warsaw office with an office-centric hybrid schedule. The standard in-office days are&nbsp;Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from&nbsp;home on Fridays depends on the type of work you do, and your recruiter can share more about the in-office requirements.<br>We offer a Contract of Employment (UoP) for our employees in Poland.</p> <p><strong>What you’ll achieve</strong></p> <ul> <li><strong>Team Leadership &amp; People Management: </strong>Lead, manage, and grow a team of Security Threat Response&nbsp;Engineers, providing technical direction, regular 1:1 coaching, performance management, and career&nbsp;development support.</li> <li><strong>Talent Acquisition: </strong>Hire and onboard exceptional security talent, building a team with complementary skills&nbsp;across incident response, detection engineering, and threat intelligence.</li> <li><strong>Culture &amp; Operations: </strong>Create a high-trust, high-performance team culture grounded in continuous learning&nbsp;and psychological safety while defining and managing on-call/stand-by schedules sustainably.</li> <li><strong>Incident Response Leadership:</strong> Own and continuously mature Asana's Security Incident Response programme (strategy, policies, playbooks, runbooks); act as an escalation point and provide hands-on technical&nbsp;leadership during high-severity incidents.</li> <li><strong>Program Testing &amp; Metrics: </strong>Drive a structured programme of tabletop exercises and simulated incident&nbsp;scenarios; define and track metrics such as MTTD and MTTR to report regularly to senior leadership.</li> <li><strong>Threat Capabilities:&nbsp;</strong>Leverage CTI, MISP, OpenCTI, STIX/TAXII, or ISACs for threat-informed detection, threat hunting, and utilize Priority Intelligence Requirements (PIRs) to support major incidents.</li> <li><strong>Hybrid SOC Architecture:&nbsp;</strong>Design, implement, and govern a hybrid, layered SOC operating model combining Asana’s internal team with an external Managed Security Service Provider (MSSP) to ensure seamless 24/7 coverage and SLA compliance.</li> <li><strong>Detection &amp; Tooling Optimization: </strong>Oversee the optimization of core security platforms like Panther (SIEM) and CrowdStrike (EDR) while tuning the detection engineering practice to map against the MITRE ATT&amp;CK framework.</li> <li><strong>Vulnerability &amp; Automation:&nbsp;</strong>Manage and mature the risk-prioritized vulnerability management programme and champion the adoption of orchestration (SOAR) and automation tools to reduce manual toil.</li> <li><strong>Cross-Functional Collaboration &amp; Compliance: </strong>Partner with internal infrastructure, IT, and Group Tech Leads to align operations with organizational security roadmaps while ensuring alignment with frameworks like SOC 2, ISO 27001, NIST CSF, and FedRAMP environments.</li> </ul> <p><strong>About you</strong></p> <ul> <li>7+ years of experience in security operations, incident response, or threat detection, including at least 2 years in&nbsp;a formal people management or team lead role within a security function.</li> <li>Deep, hands-on technical expertise managing complex security incidents end-to-end, with the ability to perform forensic analysis in complex environments.</li> <li>Strong experience utilizing SIEM platforms (e.g., Panther, Splunk, Elastic Security) for log analysis, alert&nbsp;correlation, detection development, and dashboard creation.</li> <li>Deep working knowledge of EDR tools (e.g., CrowdStrike, SentinelOne) for detection, response, and threat&nbsp;hunting across enterprise platforms, including macOS environments.</li> <li>Production experience developing and implementing security automation using scripting languages (e.g.&nbsp;Python, PowerShell) or SOAR orchestration platforms.</li> <li>Strong familiarity with common adversary tactics, techniques, and procedures (TTPs) and frameworks such as&nbsp;MITRE ATT&amp;CK, with hands-on exposure to cloud environments like AWS (CloudTrail, GuardDuty, Security<br>Hub, IAM forensics).</li> <li>Demonstrated experience designing or maturing an Incident Response programme, as well as setting up or&nbsp;governing external MSSP partnerships and hybrid SOC tiers.</li> <li>Working knowledge of relevant security compliance standards and frameworks, such as NIST CSF, ISO 27001,&nbsp;SOC 2, and FedRAMP reporting timelines or evidence requirements.</li> <li>Excellent communication and leadership skills, capable of translating technical incident details into clear&nbsp;executive summaries while maintaining a collaborative, empathetic, and calm approach under pressure.</li> <li>Flexibility to support periodic stand-by duties and manage out-of-hours escalations, with an understanding of&nbsp;operational demand balances.</li> <li>Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them&nbsp;to enhance productivity, collaboration, or decision-making.</li> </ul> <p>At Asana, we're committed to building teams that include a variety of backgrounds, perspectives, and skills, as this is&nbsp;critical to helping us achieve our mission. If you're interested in this role and don't meet every listed requirement, we still&nbsp;encourage you to apply.</p> <p><strong>What we’ll offer</strong></p> <ul> <li>Generous, transparent and fair compensation system (base salary and RSUs).</li> <li>Contract of Employment (and the option of 50% tax deductible costs for author’s rights usage in respect of&nbsp;applicable roles).</li> <li>Health insurance with dental and travel coverage (Lux Med).</li> <li>Breakfast and lunch catering on the days that you work from the office.</li> <li>Vacation allowance.</li> <li>Career growth budget.</li> <li>Home office setup budget.</li> <li>Gym/Fitness card.</li> <li>Fertility healthcare and family-forming support with Carrot.</li> <li>Mental Health Support in Modern Health.</li> <li>Group life insurance.</li> <li>MacBooks with all necessary accessories.</li> </ul> <p