Senior AppSec Engineer: Cloud-Native & SDLC Expert

Fortinet; Sunnyvale (CA); On-site; USD 147,000 - 180,000; Full time

Benefits offered by this job

Medical benefits

Dental benefits

Vision benefits

401(k)

Paid holidays

Job summary

Fortinet is seeking a Sr. Application Security Engineer to join Corporate Information Security. The role involves security reviews on Fortinet apps, education for engineers, and handling externally reported vulnerabilities.

You will work with development teams on code reviews, penetration tests, and architectural reviews. The position emphasizes SDLC security, CSIRT-like responsible disclosure, and building a robust testing program across SAST/DAST/IAST/SCA.

Qualifications

• 5+ years in Information Security Researcher/Engineer
• Hands-on auditing source code in Java, .NET, Python or JavaScript
• Strong OWASP Top 10 knowledge
• Experience with API security risks and cloud-native architecture
• Proven security code review and application penetration testing
• Familiarity with CSP, SOP, CORS and secure AI development

Responsibilities

• Serve as an application security SME guiding internal teams
• Perform code reviews, pen tests, and architectural reviews
• Develop and communicate vulnerability mitigation strategies
• Handle externally reported vulnerabilities via Responsible Disclosure
• Drive static and dynamic testing programs (SAST/DAST/IAST/SCA)
• Advise on SDLC best practices and secure DevOps
• Research new attack vectors and share knowledge with the global team

Skills

Application security

Code review

Penetration testing

OWASP Top 10

Cloud security

DevSecOps

Threat modeling

Communication

Education

BS in Computer Science or Cyber Security

Security certifications (OSWE/OSCP/GWEB/GPEN)

Tools

SAST tools

DAST tools

IAST tools

SCA tools

CI/CD tooling

Job description

Fortinet is seeking a Sr. Application Security Engineer to join Corporate Information Security. The role involves security reviews on Fortinet apps, education for engineers, and handling externally reported vulnerabilities.

You will work with development teams on code reviews, penetration tests, and architectural reviews. The position emphasizes SDLC security, CSIRT-like responsible disclosure, and building a robust testing program across SAST/DAST/IAST/SCA.