Security Operations Engineer Asana
San Francisco, CA

Job Description

At Asana, we're building collaboration & communication software to help every team in the world become more effective in working together and in realizing their visions. Asana has grown to millions of users across 192 countries worldwide. Our rapid growth is due, in part, thanks to the word-of-mouth of our customer advocates and the growth of our sales efforts.

This role reports to Asana's Head of Security and is located in San Francisco, California.

As a Security Operations Engineer, you'll:

* Choose, deploy, and/or manage tooling used to maintain our security stance, detect intrusions, and respond to them
* Bring experience and judgement to developing and enacting flexible and effective policies based on a deep understanding of security, not just textbook best practices
* Participate in the selection and configuration of existing and new systems from inside and outside the company to ensure they keep us and our users secure
* Build relationships across the company with functions including Engineering, Data Science, IT, and Business Technology to ensure strong security stances, educate about good security practices and motivations, and keep Security Team informed about their needs
* Collaborate with customer-facing teams to meet the business needs that Security is responsible for, such as compliance or crafting externally visible documentation

Necessary skills include:

* 5 years of Security Operations experience or equivalent in a large and growing Linux or Unix-like environment
* Configuration of large distributed production systems
* Comfort building tooling and automation to manage and monitor systems at scale
* Cross-company collaboration to meet business needs while maintaining the highest security standards

Nice skills or experience to have include:

* AWS or similar infrastructure
* Meeting certification regimes such as SOC 2 and ISO 27001 and compliance with Sarbanes-Oxley while minimizing overhead that does not provide security value
* interaction with customers gauging our security to answer questions not covered by our primary customer contact teams
* an understanding of the prerequisites and deployment of high-signal, low-noise intrusion detection, and effective intrusion containment and response