Senior App Security Engineer: Secure Dev & Pentest Lead

Perception Point; Sunnyvale (CA); On-site; USD 147,000 - 180,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k)

Paid holidays

Paid vacation and sick time

Job summary

Fortinet is seeking a Sr. Application Security Engineer to join the Corporate Information Security team in Sunnyvale, CA. You will guide internal teams on application security, conduct code reviews, perform pentests, and review architectures for secure feature development.

You will drive vulnerability mitigation, manage externally reported issues, and shape the secure SDLC. A strong background in OWASP, API security, cloud-native architectures, and DevSecOps is required.

Qualifications

• 5+ years in Information Security or Security Engineering.
• Hands-on auditing of source code for security issues.
• Proficient in Java, .NET, Python or JavaScript frameworks.
• Strong knowledge of common API security risks and OWASP Top 10.

Responsibilities

• Provide guidance as an application security SME to internal teams.
• Perform code reviews, penetration tests, and architecture reviews.
• Develop vulnerability mitigation strategies for developers.
• Handle externally reported vulnerabilities via Responsible Disclosure.
• Advise on SDLC best practices and secure development.
• Lead and participate in CI/CD, DevSecOps, and security tooling.

Skills

Application security

Code review

Penetration testing

OWASP Top 10

Cloud-native / microservices

DevSecOps

Threat modeling

Communication

Education

BS in Computer Science or Cyber Security or related field

Tools

DAST

SAST

IAST

SCA

Job description

Fortinet is seeking a Sr. Application Security Engineer to join the Corporate Information Security team in Sunnyvale, CA. You will guide internal teams on application security, conduct code reviews, perform pentests, and review architectures for secure feature development.

You will drive vulnerability mitigation, manage externally reported issues, and shape the secure SDLC. A strong background in OWASP, API security, cloud-native architectures, and DevSecOps is required.