Security Compliance Lead

Join Asana as a Security Compliance Lead, where you will play a crucial role in maturing and operating our compliance and certification program. You will work closely with various teams, including Security Engineering, Legal, Privacy, and R&D, to ensure the effectiveness of our controls and the maintenance of our certifications. This is an excellent opportunity for someone with early-career GRC experience who is excited to grow their technical skills and help shape our approach to compliance automation.

• Support the maintenance and continuous improvement of Asana’s control framework, tracking control effectiveness across SOC 2, ISO 27001, FedRAMP Moderate, and other applicable standards.
• Own the monthly FedRAMP ConMon package submission, ensuring it is accurate, complete, and delivered on time every month.
• Own evidence collection workflows within our GRC platform, ensuring controls are reliably mapped, evidence is current, and audit artefacts are ready year-round.

• This is an excellent opportunity for someone with early-career GRC experience who is excited to grow their technical skills and help shape how a high-growth SaaS company approaches compliance automation
• A clear communicator who can translate compliance requirements into plain language for both technical and non-technical stakeholders
• Curious about how modern SaaS engineering works—comfortable asking questions and learning the technical context behind a control
• Comfortable engaging with a wide variety of teams—Engineering, People, IT, Legal—to explain compliance requirements, gather evidence, and build the relationships needed to close control gaps
• Organised and deadline-driven: you can manage multiple workstreams, track time-sensitive obligations (like monthly FedRAMP submissions), and keep audit artefacts tidy without being reminded
• At Asana, we’re committed to building teams that include a variety of backgrounds, perspectives, and skills, as this is critical to helping us achieve our mission. If you’re interested in this role and don’t meet every listed requirement, we still encourage you to apply
• Foundational knowledge of security compliance frameworks such as SOC 2, ISO 27001, NIST CSF, or FedRAMP; you don’t need to be an expert in all of them
• 3+ years of experience in Governance, Risk, and Compliance (GRC), information security, or a closely related field—internships and co-ops count
• Exposure to compliance automation or evidence collection tooling (GRC platforms, scripting, API integrations) is a plus, but not essential—curiosity and a willingness to grow technically matter more