Senior Application Security Engineer

Fortinet; City Of London; On-site; GBP 70,000 - 90,000; Full time

Benefits offered by this job

Comprehensive benefits

Training programs

Job summary

A leading cybersecurity company in London is seeking a Senior Application Security Engineer to conduct security reviews, perform code audits, and guide development teams on best practices. The ideal candidate will have over 5 years in information security, strong knowledge of security testing tools, and experience with secure coding practices. This role supports a dynamic environment focused on protecting critical data and applications.

Qualifications

• 5+ years of experience in Information Security.
• 3+ years of experience with code auditing.
• Proven experience in application security testing tools.

Responsibilities

• Conduct security reviews on applications.
• Perform code reviews and penetration tests.
• Advise teams on SDLC best practices.

Skills

Information Security Researcher or Engineer

Auditing source code

OWASP TOP 10 vulnerabilities

API security risks

Cloud-Native application architecture

Application penetration testing

Security code review

DAST, SAST, IAST, SCA tools

Computer and network security

Web security standards

CI/CD pipelines

Threat modeling methodologies

Web proxies

OAuth and JWT implementations

Communication skills

Education

BS degree in Computer Science or Cyber Security

Tools

Burp

OWASP ZAP

Fiddler

Job description

Overview

Senior Application Security Engineer role at Fortinet. This is a highly technical role within the Corporate Information Security team, with responsibilities including conducting security reviews on Fortinet applications, providing security education to engineers, and handling externally reported vulnerabilities.

Key Responsibilities

• Serve as an application security subject matter expert who provides guidance to internal teams
• Work closely with development teams, perform code reviews, penetration tests, and architectural reviews on existing code and new features
• Develop, implement, and communicate vulnerability mitigation strategies to development teams
• Handle externally reported vulnerabilities as a member of the Corporate Information Security Responsible Disclosure Program committee
• Drive Fortinet static and dynamic application security testing program
• Develop strategies, evaluate solutions, design and implement tools, processes and controls to ensure that security and privacy are designed in Fortinet applications
• Advise development teams on SDLC best practices
• Proactively research new attack vectors on applications that may affect Fortinet applications and infrastructure
• Be part of a global distributed team to share knowledge, workload and assignments. Coach peers in application security concepts and best practices

Required Skills/Experience

• 5+ years of work experience as an Information Security Researcher or Engineer
• 3+ years of experience with manually auditing source code to find security issues or programming skills in one or more of: Java, .NET, Python or JavaScript frameworks
• Strong understanding of OWASP TOP 10 vulnerabilities
• Strong understanding of common API security risks
• Strong understanding of Cloud-Native application architecture, microservices, containerization technologies, secure deployment and implementation issues
• Proven experience in application penetration testing
• Proven experience in security code review
• Proven experience in application security testing (DAST, SAST, IAST, SCA) tools and processes
• Strong foundation in computer and network security, authentication & authorization, security protocols and applied cryptography
• Solid understanding of web security standards such as CSP, SOP, CORS, and emerging web security technologies
• Solid understanding of CI/CD pipelines, build systems and DevSecOps principles
• Experience defining security architecture patterns and standards in a large enterprise organization
• Experience with cloud-based security solutions and familiarity with cloud service providers, particularly in relation to application security
• Experience working with threat modeling methodologies such as MITRE ATT&CK, STRIDE, PASTA
• Efficiency with web proxies such as Burp or OWASP ZAP or Fiddler
• Understanding of OAuth and JWT implementations
• Ability to organize and communicate effectively, both written and verbal, with technical and non-technical people across functional teams
• A BS degree in Computer Science, Cyber Security, other tech-related degree, or equivalent experience
• Experience in Cloud Security Posture Management (CSPM) and/or Application Security Posture Management (ASPM) tools is a plus
• Having OSWE OSCP, GWEB, GPEN or similar certification is a plus
• Experience in Mobile Application Penetration Testing is a plus
• Familiarity with AI, ML & LLM concepts, AI Red Teaming, AI Guardrails is a plus

About Us

Fortinet makes possible a digital world that we can always trust through its mission to protect people, devices, and data everywhere. This is why the world’s largest enterprises, service providers, and government organizations choose Fortinet to securely accelerate their digital journey. The Fortinet Security Fabric platform delivers broad, integrated, and automated protections across the entire digital attack surface, securing critical devices, data, applications, and connections from the data center to the cloud to the home office. Ranking #1 in the most security appliances shipped worldwide, more than 615,000 customers trust Fortinet to protect their businesses. The Fortinet NSE Training Institute provides one of the largest and broadest training programs in the industry to make cyber training and new career opportunities available to everyone.

Seniority level

• Mid-Senior level

Employment type

• Full-time

Job function

• Information Technology

Industries

• Computer and Network Security