Software Engineer - FortiSIEM Threat Detection & Integration

Perception Point; Sunnyvale (CA); On-site; USD 123,000 - 151,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

401(k)

Paid holidays

Vacation time

Sick time

Comprehensive leave program

Job summary

Fortinet in the United States is seeking a software engineer for the FortiSIEM Advanced Threat Integration team. The role blends hands-on software development with security detection engineering, focusing on data-path ingestion, parsing, and detecting content.

You will write production code and tooling to normalize telemetry and deliver reliable detections. The position requires working knowledge of Python, Linux, and Git/GitLab, plus experience with SIEM concepts, regex parsing, and building

Qualifications

• BS in Computer Science, Computer Engineering, Cybersecurity, or related field, or equivalent experience.
• 3+ years of software engineering with BS, or 2+ years with MS.
• Strong Python programming skills including data structures, I/O, testing, and debugging.
• Strong regex skills and ability to parse untrusted logs.
• Solid understanding of algorithms, data structures, and concurrency basics.
• Good Linux knowledge including shell, networking basics, and scripting.
• Git/GitLab knowledge and collaborative workflows.
• Ability to read unfamiliar logs, APIs, schemas and convert to deterministic software.
• Strong debugging and problem-solving with edge cases and testing.
• Effective communication in distributed engineering teams.

Responsibilities

• Analyze raw security and audit logs from Fortinet and third-party products to understand their structure and important fields.
• Build and maintain FortiSIEM log parsers that extract and normalize data into standard event attributes.
• Create and update FortiSIEM security rules, reports, dashboards, and related detection content.
• Research vendor documentation, advisories, and sample logs to support new integrations and detections.
• Develop and maintain lightweight integrations and supporting tools using Python, regex, APIs, and basic scripting.
• Test and troubleshoot parsers, rules, and integrations using representative log samples and expected results.
• Work in Linux environments and use Git/GitLab for source control, code review, and team development.
• Collaborate with developers, QA, support, and security researchers to review, validate, and release FortiSIEM content.

Skills

Python

Regex parsing

Linux basics

Git/GitLab

Data structures

Algorithms

Debugging

Problem solving

Log analysis

Education

BS in Computer Science, Computer Engineering, Cybersecurity, or related field

Tools

REST APIs

JSON

XML

Syslog

Job description

We are seeking a software engineer to join the FortiSIEM Advanced Threat Integration engineering team. This role combines hands-on software development with security detection engineering. The engineer will work close to the data path: ingesting and normalizing security telemetry, building parsers and integrations, modeling detections, and developing the supporting code and tooling required to deliver reliable FortiSIEM content.

Responsibilities

• Analyze raw security and audit logs from Fortinet and third-party products to understand their structure and important fields.
• Build and maintain FortiSIEM log parsers that extract and normalize data into standard event attributes.
• Create and update FortiSIEM security rules, reports, dashboards, and related detection content.
• Research vendor documentation, advisories, and sample logs to support new integrations and detections.
• Develop and maintain lightweight integrations and supporting tools using Python, regex, APIs, and basic scripting.
• Test and troubleshoot parsers, rules, and integrations using representative log samples and expected results.
• Work in Linux environments and use Git/GitLab for source control, code review, and team development.
• Collaborate with developers, QA, support, and security researchers to review, validate, and release FortiSIEM content.

Required Qualifications

• BS in Computer Science, Computer Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.
• 3+ years of software engineering experience for candidates with a BS, or 2+ years with an MS.
• Strong Python programming skills, including data structures, file and network I/O, error handling, testing, and debugging.
• Strong regular-expression skills and the ability to reason about correctness and performance when parsing untrusted or irregular log data.
• Solid understanding of core programming concepts including algorithms, data structures, complexity, object-oriented design, and concurrent or asynchronous execution where applicable.
• Good working knowledge of Linux, including processes, files, permissions, networking basics, command-line troubleshooting, and shell scripting.
• Working knowledge of Git/GitLab and collaborative code-review workflows.
• Ability to read unfamiliar logs, APIs, schemas, and vendor documentation and convert them into deterministic software and detection logic.
• Strong debugging and problem-solving ability, with attention to edge cases and reproducible testing.
• Ability to work effectively in a distributed engineering team and to communicate technical reasoning clearly.

Security / SIEM Knowledge

• Experience with SIEM, security analytics, log management, EDR, firewall, identity, cloud, or other security telemetry is strongly preferred.
• Understanding of common security event concepts such as source/destination identity, authentication events, process execution, network activity, vulnerabilities, and security-product actions.
• Familiarity with detection engineering concepts such as false positives, detection coverage, correlation, baselining, thresholds, and MITRE ATT&CK is a plus.
• Prior experience developing SIEM parsers, correlation rules, Sigma-style detections, or security-content packages is a strong plus.

Preferred / Nice to Have

• Working knowledge of C++ for lower-level or performance-sensitive components.
• Experience with REST APIs, JSON, XML, syslog, TLS, sockets, and common authentication mechanisms.
• Experience with distributed or high-throughput event-processing systems.
• Experience with at least one public cloud platform (AWS, Azure, or GCP).
• Experience building developer tooling, automated test harnesses, or CI/CD checks for data/content pipelines.

What This Role Is

This is not a pure security-analyst role and not a generic application-development role. The engineer is expected to write production code and tooling while also understanding how security telemetry should be normalized and converted into reliable detections. The role sits at the boundary between software engineering, data parsing/integration, and detection engineering.

Must be authorized to work in the U.S. without sponsorship.

• The US base salary range for this full-time position is $123,000-$151,000.
• Fortinet offers employees a variety of benefits, including medical, dental, vision, life and disability insurance, 401(k), 11 paid holidays, vacation time, and sick time, as well as a comprehensive leave program.
• All roles are eligible to participate in the Fortinet equity program. Bonus eligibility is reviewed at the time of hire and annually at the Company's discretion.

Why Join Us

We encourage candidates from all backgrounds and identities to apply. We offer a supportive work environment and a competitive Total Rewards package to support you with your overall health and financial well-being.

Embark on a challenging, enjoyable, and rewarding career journey with Fortinet. Join us in bringing solutions that make a meaningful and lasting impact to our 890,000+ customers around the globe.

Fortinet (NASDAQ: FTNT) secures the largest enterprise, service provider, and government organizations around the world. Fortinet empowers its customers with intelligent, seamless protection across the expanding attack surface and the power to take on ever-increasing performance requirements of the borderless network - today and into the future. Only the Fortinet Security Fabric architecture can deliver security without compromise to address the most critical security challenges, whether in networked, application, cloud or mobile environments. Fortinet ranks number one in the most security appliances shipped worldwide and more than 500,000 customers trust Fortinet to protect their businesses. We are committed to providing reasonable accommodations for all qualified individuals with disabilities. If you require assistance or accommodation due to a disability, please contact us at [e-mail]. Fortinet is an equal opportunity employer. We value diversity in our company, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, age, military/veteran status or any other applicable legally protected characteristics in the location in which the candidate is applying.