Senior Application Security Engineer

Fortinet; Reading; On-site; GBP 60,000 - 90,000; Full time

Job summary

A leading technology company is seeking a Senior Application Security Engineer to enhance application security within their team in Reading, United Kingdom. This role requires in-depth knowledge of security practices, strong collaboration with development teams, and expertise in conducting security assessments and implementing best practices. Candidates should have substantial experience in information security, familiarity with industry standards such as OWASP, and a degree related to computer science or cybersecurity.

Qualifications

• 5+ years of experience in Information Security.
• Strong understanding of OWASP TOP 10 vulnerabilities and Cloud-Native architectures.
• Proficiency in application security testing tools and security protocols.

Responsibilities

• Conduct security reviews and assess vulnerabilities for various Fortinet applications.
• Collaborate with development teams for code reviews and develop mitigation strategies.
• Drive the application security testing program and ensure security is integrated into development.

Skills

Application Penetration Testing

Cloud Security

Security Code Review

API Security

DevSecOps

Education

BS degree in Computer Science or Cyber Security

Tools

Burp Suite

OWASP ZAP

Fiddler

Job description

Social network you want to login/join with:

Senior Application Security Engineer, Reading

col-narrow-left

Client:

Fortinet

Location:

Reading, United Kingdom

Job Category:

Other

-

EU work permit required:

Yes

col-narrow-right

Job Reference:

ef8bbc624876

Job Views:

6

Posted:

19.08.2025

Expiry Date:

03.10.2025

col-wide

Job Description:

Senior Application Security Engineer

Fortinet is looking for a Sr. Application Security Engineer to join the Corporate Information Security team. This is a highly technical role, with responsibilities conducting security reviews on various Fortinet applications, providing security education to our engineers and handling externally reported vulnerabilities.

Key Responsibilities:

• Serve as an application security subject matter expert who provides guidance to internal teams
• Work closely with development teams, perform code reviews, penetration tests, and architectural reviews on existing codes and new features.
• Develop, implement, and communicate vulnerability mitigation strategies to development teams
• Handle externally reported vulnerabilities as a member of Corporate Information Security Responsible Disclosure Program committee.
• Drive Fortinet static and dynamic application security testing program.
• Develop strategies, evaluate solutions, design and implement tools, processes and controls to ensure that security and privacy are designed in Fortinet applications
• Advise development teams on SDLC best practices.
• Proactively research new attack vectors on applications that may affectFortinet applications and infrastructure.
• Be part of a global distributed team to share knowledge, workload and assignments. Strong sense of teamwork is required. Coach peers in application security concepts and best practices.

Required Skills/Experience:

• 5+ years of work experience as an Information Security Researcher or Engineer
• Strong understanding on OWASP TOP 10 vulnerabilities.
• Strong understanding of common API security risks
• Strong understanding on Cloud-Native application architecture, microservices, containerization technologies, secure deployment and implementation issues.
• Proven experience in application penetration testing
• Proven experience in security code review
• Proven experience in application security testing (DAST, SAST, IAST, SCA) tools and processes
• Strong foundation in computer and network security, authentication & authorization, security protocols and applied cryptography
• Solid understanding with web security standards such as CSP, SOP, CORS, and emerging web security technologies.
• Solid understanding on CI/CD pipelines, build systems and DevSecOps principles.
• Experience defining security architecture patterns and standards in a large enterprise organization.
• Experience with cloud-based security solutions and familiarity with cloud service providers, particularly in relation to application security
• Experience working with threat modeling methodologies such as MITRE ATT&CK, STRIDE, PASTA etc.
• Efficiency with web proxies such as Burp or OWASP ZAP or Fiddler
• Understanding of OAuth and JWT implementations.
• Ability to organize & communicate effectively, both written and verbal, with technical and non-technical people across functional teams
• A BS degree in Computer Science, Cyber Security, other tech-related degree, or equivalent experience.
• Experience in Cloud Security Posture Management (CSPM) and/or Application Security Posture Management (ASPM) tools is a plus.
• Having OSWE OSCP, GWEB, GPEN or similar certificate is a plus
• Experience in Mobile Application Penetration Testing is a plus
• Familiarity with AI&ML & LLM concepts, AI Red Teaming, AI Guardrails is a plus.