Sr Applications Security Engineer

Fortinet, Inc.; Sunnyvale (CA); On-site; USD 147,000 - 180,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) retirement plan

Paid holidays, vacation, sick time

Job summary

Fortinet is seeking a Sr. Application Security Engineer to join the Corporate Information Security team.

You will be a technical expert performing security reviews across Fortinet applications, educate engineers, and handle externally reported vulnerabilities. You will drive static/dynamic testing programs, advise on SDLC security, and lead security initiatives while collaborating with a global distributed team to share knowledge, strengthen defenses, and protect assets across Fortinet’s

Qualifications

• 5+ years of work experience as an Information Security Researcher or Engineer.
• 3+ years auditing source code or programming in Java, .NET, Python or JavaScript.
• Strong understanding of OWASP TOP 10 vulnerabilities and API security risks.
• Strong understanding of cloud-native architecture, microservices, containerization, secure deployment.
• Proven experience in application penetration testing and security code review.
• Familiarity with CI/CD, DevSecOps and secure SDLC practices.
• Knowledge of OAuth and JWT implementations.
• BS degree in Computer Science, Cyber Security, or related field.

Responsibilities

• Serve as an application security expert guiding internal teams.
• Perform code reviews, pen tests, and architectural reviews on Fortinet apps.
• Develop and communicate vulnerability mitigation strategies to developers.

Skills

Information Security

Code auditing

OWASP Top 10

API security

Cloud-native

Penetration testing

Security code review

CI/CD / DevSecOps

Threat modeling

OAuth / JWT

Education

BS degree in Computer Science or related field

Tools

SAST tools

DAST tools

IAST tools

SCA tools

Job description

Fortinet is looking for a Sr. Application Security Engineer to join the Corporate Information Security team. This is a highly technical role, with responsibilities conducting security reviews on various Fortinet applications, providing security education to our engineers and handling externally reported vulnerabilities.

Key Responsibilities:

• Serve as an application security subject matter expert who provides guidance to internal teams
• Work closely with development teams, perform code reviews, penetration tests, and architectural reviews on existing codes and new features.
• Develop, implement, and communicate vulnerability mitigation strategies to development teams
• Handle externally reported vulnerabilities as a member of Corporate Information Security Responsible Disclosure Program committee.
• Drive Fortinet static and dynamic application security testing program.
• Develop strategies, evaluate solutions, design and implement tools, processes and controls to ensure that security and privacy are designed in Fortinet applications
• Advise development teams on SDLC best practices.
• Proactively research new attack vectors on applications that may affectFortinet applications and infrastructure.
• Be part of a global distributed team to share knowledge, workload and assignments. Strong sense of teamwork is required. Coach peers in application security concepts and best practices.

Required Skills/Experience:

• 5+ years of work experience as an Information Security Researcher or Engineer
• 3+ years of experience with manually auditing source code to find security issues or programming skills in one or more of: Java, .NET, Python or JavaScript frameworks.
• Strong understanding on OWASP TOP 10 vulnerabilities.
• Strong understanding of common API security risks
• Strong understanding on Cloud-Native application architecture, microservices, containerization technologies, secure deployment and implementation issues.
• Proven experience in application penetration testing
• Proven experience in security code review
• Proven experience in application security testing (DAST, SAST, IAST, SCA) tools and processes
• Strong foundation in computer and network security, authentication & authorization, security protocols and applied cryptography
• Solid understanding with web security standards such as CSP, SOP, CORS, and emerging web security technologies.
• Solid understanding on CI/CD pipelines, build systems and DevSecOps principles.
• Strong understanding with AI&ML & LLM concepts like RAG, Agentic Workflows, MCPs, Skills, AI Red Teaming, AI Guardrails and Secure AI development and deployment strategies.
• Experience defining security architecture patterns and standards in a large enterprise organization.
• Experience with cloud-based security solutions and familiarity with cloud service providers, particularly in relation to application security
• Experience working with threat modeling methodologies such as MITRE ATT&CK, STRIDE, PASTA etc.
• Understanding of OAuth and JWT implementations.
• Ability to organize & communicate effectively, both written and verbal, with technical and non-technical people across functional teams
• A BS degree in Computer Science, Cyber Security, other tech-related degree, or equivalent experience.
• Experience in Cloud Security Posture Management (CSPM) and/or Application Security Posture Management (ASPM) tools is a plus.
• Having OSWE OSCP, GWEB, GPEN or similar certificate is a plus
• Experience in Mobile Application Penetration Testing is a plus

Must be authorized to work in the U.S. without sponsorship.

The US base salary range for this full-time position is $147,000-$180,000. Fortinet offers employees a variety of benefits, including medical, dental, vision, life and disability insurance, 401(k), 11 paid holidays, vacation time, and sick time, as well as a comprehensive leave program.

Wage ranges are based on various factors, including the labour market, job type, and job level. Exact salary offers will be determined by factors such as the candidate's subject knowledge, skill level, qualifications, experience, and geographic location.

All roles are eligible to participate in the Fortinet equity program. Bonus eligibility is reviewed at the time of hire and annually at the Company’s discretion.

Why Join Us:

We encourage candidates from all backgrounds and identities to apply. We offer a supportive work environment and a competitive Total Rewards package to support you with your overall health and financial well-being.

Embark on a challenging, enjoyable, and rewarding career journey with Fortinet. Join us in bringing solutions that make a meaningful and lasting impact to our 890,000+ customers around the globe.