Manager, Offensive Security

<p><span data-path-to-node="4,0">The Security team is responsible for protecting Asana’s employees, users, and customers<span data-path-to-node="4,2">. We are a team of security engineers and risk and compliance practitioners who build innovative safeguards to ensure that our data is protected against threats and that we comply with legal, regulatory, and customer requirements</span><span data-path-to-node="4,4">. We collaborate closely with teams across the organization to foster a culture of security throughout our product and operations</span><span data-path-to-node="4,6">. We're looking for a Manager of Offensive Security to lead our Offensive Security function in Warsaw</span><span data-path-to-node="4,8">. In this role, you will own and grow a team spanning red team operations, application security, and vulnerability management, driving both the strategic direction and the hands-on execution of our offensive security program</span><span data-path-to-node="4,10">. You will work directly with engineering leadership, legal, and senior stakeholders to ensure our security posture is contin<span class="citation-1658 citation-1659 citation-end-1659">uously tested, measured, and improved</span></span></span><span data-path-to-node="4,0"><span data-path-to-node="4,12"><span class="citation-1656 citation-1657 citation-end-1657">.</span></span></span></p> <p id="p-rc_ce5dfecf57c71813-309" data-path-to-node="5"><span data-path-to-node="5,0"><span class="citation-1654 citation-1655 citation-end-1655">This role is based in our Warsaw office with an office-centric hybrid schedule</span></span><span data-path-to-node="5,2"><span class="citation-1652 citation-1653 citation-end-1653">. The standard in-office days are Monday, Tuesday, and Thursday</span></span><span data-path-to-node="5,4"><span class="citation-1650 citation-1651 citation-end-1651">. Most Asanas have the option to work from ho</span><span class="citation-1650 citation-end-1650">me on Wednesdays</span></span><span data-path-to-node="5,6"><span class="citation-1649 citation-end-1649">. Working from home on Fridays depends on the type of work you do and the t</span>eams with which you partner</span><span data-path-to-node="5,8">. If you're interviewing for this role, your recruiter will share more about the in-office requirements</span><span data-path-to-node="5,10">.</span></p> <p data-path-to-node="6">We offer a Contract of Employment (UoP) for our employees in Poland.</p> <p id="p-rc_ce5dfecf57c71813-310" data-path-to-node="7"></p> <h3 data-path-to-node="8">What you’ll achieve</h3> <ul data-path-to-node="9"> <li> <p id="p-rc_ce5dfecf57c71813-311" data-path-to-node="9,0,0"><span data-path-to-node="9,0,0,0">Lead, grow, and mentor a team of offensive security engineers across red team, application security, and vulnerability management disciplines while staying actively engaged in day-to-day technical operations</span><span data-path-to-node="9,0,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-312" data-path-to-node="9,1,0"><span data-path-to-node="9,1,0,0">Define team roadmap, OKRs, and priorities in alignment with broader security and engineering strategy</span><span data-path-to-node="9,1,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-313" data-path-to-node="9,2,0"><span data-path-to-node="9,2,0,0">Foster a culture of technical excellence, continuous learning, and psychological safety within the team, partnering with recruiting to scale the team</span><span data-path-to-node="9,2,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-314" data-path-to-node="9,3,0"><span data-path-to-node="9,3,0,0">Plan and execute red team operations and adversary simulation exercises across Asana's infrastructure, products, and corporate environment</span><span data-path-to-node="9,3,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-315" data-path-to-node="9,4,0"><span data-path-to-node="9,4,0,0">Perform cloud security assessments evaluating misconfigurations, privilege escalation paths, and lateral movement opportunities</span><span data-path-to-node="9,4,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-316" data-path-to-node="9,5,0"><span data-path-to-node="9,5,0,0">Develop and maintain red team tooling, TTPs, and playbooks aligned with current threat actor behaviors</span><span data-path-to-node="9,5,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-317" data-path-to-node="9,6,0"><span data-path-to-node="9,6,0,0">Oversee security architecture reviews and threat modeling for new features and services, ensuring risks are identified early and secure design decisions are made</span><span data-path-to-node="9,6,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-318" data-path-to-node="9,7,0"><span data-path-to-node="9,7,0,0">Own and operate Asana's bug bounty program and mature our vulnerability management program across software and infrastructure</span><span data-path-to-node="9,7,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-319" data-path-to-node="9,8,0"><span data-path-to-node="9,8,0,0">Implement technical security controls within the SDLC, including PR blockers and automated pipeline gates</span><span data-path-to-node="9,8,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-320" data-path-to-node="9,9,0"><span data-path-to-node="9,9,0,0">Translate complex technical vulnerabilities into executive-level risk reports and actionable business insights for senior leadership and legal</span><span data-path-to-node="9,9,0,2">.</span></p> </li> </ul> <h3 data-path-to-node="10">About you</h3> <ul data-path-to-node="11"> <li> <p id="p-rc_ce5dfecf57c71813-321" data-path-to-node="11,0,0"><span data-path-to-node="11,0,0,0">Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision-making</span><span data-path-to-node="11,0,0,2">.</span></p> </li> <li> <p id="p-rc_ce5dfecf57c71813-322" data-path-to-node="11,1,0"><span data-path-to-node="11,1,0,0">8+ years of experience in offensive security, application security, or closely related disciplines, with significant hands-on depth in red team operations or web application penetration testing in enterprise environments</span><span data-path-to-node=&q