Software Engineer - SIEM Detection & Data Ingestion

Perception Point; Sunnyvale (CA); On-site; USD 123,000 - 151,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

401(k)

Paid holidays

Vacation time

Sick time

Comprehensive leave program

Job summary

Fortinet in the United States is seeking a software engineer for the FortiSIEM Advanced Threat Integration team. The role blends hands-on software development with security detection engineering, focusing on data-path ingestion, parsing, and detecting content.

You will write production code and tooling to normalize telemetry and deliver reliable detections. The position requires working knowledge of Python, Linux, and Git/GitLab, plus experience with SIEM concepts, regex parsing, and building

Qualifications

• BS in Computer Science, Computer Engineering, Cybersecurity, or related field, or equivalent experience.
• 3+ years of software engineering with BS, or 2+ years with MS.
• Strong Python programming skills including data structures, I/O, testing, and debugging.
• Strong regex skills and ability to parse untrusted logs.
• Solid understanding of algorithms, data structures, and concurrency basics.
• Good Linux knowledge including shell, networking basics, and scripting.
• Git/GitLab knowledge and collaborative workflows.
• Ability to read unfamiliar logs, APIs, schemas and convert to deterministic software.
• Strong debugging and problem-solving with edge cases and testing.
• Effective communication in distributed engineering teams.

Responsibilities

• Analyze raw security and audit logs from Fortinet and third-party products to understand their structure and important fields.
• Build and maintain FortiSIEM log parsers that extract and normalize data into standard event attributes.
• Create and update FortiSIEM security rules, reports, dashboards, and related detection content.
• Research vendor documentation, advisories, and sample logs to support new integrations and detections.
• Develop and maintain lightweight integrations and supporting tools using Python, regex, APIs, and basic scripting.
• Test and troubleshoot parsers, rules, and integrations using representative log samples and expected results.
• Work in Linux environments and use Git/GitLab for source control, code review, and team development.
• Collaborate with developers, QA, support, and security researchers to review, validate, and release FortiSIEM content.

Skills

Python

Regex parsing

Linux basics

Git/GitLab

Data structures

Algorithms

Debugging

Problem solving

Log analysis

Education

BS in Computer Science, Computer Engineering, Cybersecurity, or related field

Tools

REST APIs

JSON

XML

Syslog

Job description

Fortinet in the United States is seeking a software engineer for the FortiSIEM Advanced Threat Integration team. The role blends hands-on software development with security detection engineering, focusing on data-path ingestion, parsing, and detecting content.

You will write production code and tooling to normalize telemetry and deliver reliable detections. The position requires working knowledge of Python, Linux, and Git/GitLab, plus experience with SIEM concepts, regex parsing, and building