Third Party Risk Management Lead

At Asana security is foundational to our mission of helping teams work together effortlessly. Our security team protects Asana’s employees users and customers by proactively addressing threats ensuring compliance with legal and regulatory requirements and fostering a culture of security throughout our product and operations. We are a team of security engineers and risk and compliance practitioners who build innovative safeguards and collaborate across the organization to build and maintain trust at scale.

As the Third Party Risk Management Lead you will be responsible for building and running Asana’s Third Party Risk Management (TPRM) program. You will own the end-to-end lifecycle of vendor security risk from initial due diligence and risk tiering through ongoing monitoring and remediation. You will work closely with Procurement Legal Privacy and Engineering teams to ensure that our third-party relationships are effectively assessed tracked and managed.

This role is based in our Vancouver office with an office-centric hybrid schedule. The standard in-office days are Monday Tuesday and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do and the teams with which you partner. If you re interviewing for this role your recruiter will share more about the in-office requirements.

What you’ll achieve

Own and scale Asana’s TPRM program Design implement and continuously improve a risk-based framework for assessing and managing third-party vendors and service providers. Establish risk tiering criteria assessment workflows and governance processes that scale with business growth. Lead vendor security assessments Conduct and oversee security due diligence for new and existing vendors including reviewing SOC 2 reports ISO 27001 certifications security questionnaires (SIG CAIQ) and other relevant documentation. Identify gaps and work with vendors to remediate findings. Drive remediation and risk acceptance Track and manage open findings from vendor assessments work with internal stakeholders to prioritize remediation and facilitate formal risk acceptance processes where appropriate. Ensure findings are documented and resolved in a timely manner. Manage ongoing third-party monitoring Develop and execute a continuous monitoring strategy for critical and high-risk vendors including periodic reassessments breach notifications and security posture updates. Maintain an accurate and up-to-date vendor risk inventory. Review security provisions in vendor contracts Collaborate with Legal and Privacy teams to assess and negotiate security-related clauses in vendor agreements data processing addenda and subprocessor agreements ensuring alignment with Asana’s policies and obligations. Report on TPRM program health Develop metrics and reporting to communicate the state of third-party risk to senior leadership and relevant stakeholders. Support audit and compliance activities by providing evidence of TPRM program effectiveness including for SOC 2 ISO 27001 and customer audits. Operate globally Work with a global team to ensure appropriate coverage and coordination across timezones supporting vendor assessments and risk decisions that multiple regions.

About you

5+ years of experience in third-party risk management vendor risk assessment or a related information security discipline. knowledge of TPRM frameworks and standards including SIG CAIQ NIST SP 800-161 ISO 27001 and SOC 2. Experience conducting vendor security assessments and reviewing third-party security documentation (audit reports certifications penetration test summaries etc.). Solid understanding of core security principles cloud environments data privacy and compliance standards relevant to B2B SaaS organizations. Proven ability to build and operationalize scalable risk management processes and develop metrics for tracking program effectiveness. Excellent communication skills with the ability to translate technical risk findings into clear actionable language for both technical and non-technical audiences. Experience collaborating cross-functionally with Procurement Legal Privacy and Engineering teams. Demonstrates curiosity about AI tools and emerging technologies with a willingness to learn and leverage them to enhance productivity collaboration or decision-making.

At Asana we re committed to building teams that include a variety of backgrounds perspectives and skills as this is critical to helping us achieve our mission. If you re interested in this role and don t meet every listed requirement we still encourage you to apply.

What we ll offer

Our comprehensive compensation package plays a big part in how we recognize you for the impact you have on our path to achieving our mission. We believe that compensation should be reflective of the value you create relative to the market value of your role. To ensure pay is fair and not impacted by biases we re committed to looking at market value which is why we check ourselves and conduct a yearly pay equity audit.

For this role the estimated base salary range is between $123,000-140,000 CAD. The actual base salary will vary based on various factors including market and individual qualifications objectively assessed during the interview process. The listed range above is a guideline and the base salary range for this role may be modified.

In addition to base salary your compensation package may include additional components such as equity sales incentive pay (for most sales roles) and benefits. If you re interviewing for this role speak with your Talent Acquisition Partner to learn more about the total compensation and benefits for this role.

We strive to provide equitable and competitive benefits packages that support our employees worldwide and include

Mental health wellness fitness benefits Career coaching support Inclusive family building benefits Long-term savings or retirement plans In-office culinary options to cater to your dietary preferences

These are just some of the benefits we offer and benefits may vary based on role country and local regulations. If you re interviewing for this role speak with your Talent Acquisition Partner to learn more about the total compensation and benefits for this role.

# -Hybrid

About us

1 Asana is a leading platform for human + AI collaboration. Millions of teams around the world rely on Asana to achieve their most important goals faster. Asana has been named to Fortune s Best Workplaces for 7+ years and recognized by Fast Company Forbes and Gartner for excellence in workplace culture and innovation. We offer an exceptional office-centric culture while adopting the best elements of hybrid models to ensure that every one of our global team members can work together effortlessly. With 13+ offices all over the world we are always looking for individuals who care about building technology that drives positive change in the world and a culture where everyone feels that they belong.

TypographyPresentation_31345133_root--medium RichText3-paragraph--withVSpacingNormal RichText3-paragraph HighlightSol_1625403506_highlightSol HighlightSol_1625403506_buildingBlock left We believe in supporting people to do their best work and thrive. Our goal is to ensure that Asana upholds an environment where all people feel that they are respected and valued whether they are applying for an open position or working at the company. We provide equal employment opportunities to all applicants without regard to race color religion age sex national origin disability status genetics protected veteran status sexual orientation gender identity or expression or any other characteristic protected by law.

1 strong a LinkPrimaryPresentation LinkPrimaryPresentation--sentimentSelected PrimaryLink HighlightSol HighlightSol--core HighlightSol--buildingBlock Join Asana’s Talent Network;to stay up to date on job opportunities and life at Asana.