Threat Detection & SIEM Data Parser Engineer

Fortinet Inc.; Sunnyvale (CA); On-site; USD 123,000 - 151,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

Life and disability insurance

401(k)

11 paid holidays

Vacation and sick time

Equity program

Job summary

Fortinet Inc. is seeking a software engineer to join the FortiSIEM Advanced Threat Integration team. You will develop production code and tooling, while understanding how security telemetry is normalized into reliable detections.

The role sits at the boundary of software engineering, data parsing, and detection engineering, with collaboration across teams and a focus on high-quality, scalable content.

Qualifications

• BS in Computer Science, Computer Engineering, Cybersecurity, or related field, or equivalent practical experience.
• 3+ years of software engineering experience for BS candidates, or 2+ years with MS.
• Strong Python programming skills including data structures, I/O, error handling, testing, debugging.
• Strong regex skills and ability to reason about correctness and performance when parsing logs.
• Solid understanding of algorithms, data structures, complexity, OOD, and async/concurrent execution.
• Good working knowledge of Linux and shell scripting.
• Working knowledge of Git/GitLab and collaborative code-review workflows.
• Ability to read logs, APIs, schemas and convert to deterministic software and detection logic.

Responsibilities

• Analyze raw security and audit logs to understand structure and fields.
• Build and maintain FortiSIEM log parsers to normalize data into standard events.
• Create and update security rules, reports, dashboards, and detection content.
• Research vendor docs, advisories, and sample logs for new integrations and detections.
• Develop lightweight integrations using Python, regex, APIs, and scripting.
• Test parsers, rules, and integrations with representative samples and results.
• Work in Linux environments and use Git/GitLab for source control and reviews.
• Collaborate with developers, QA, support, and researchers to release content.

Skills

Python

Regex

Linux

Git/GitLab

Log parsing

Detection engineering

Problem-solving

Teamwork

Education

BS in Computer Science or related field

Equivalent practical experience

Tools

REST APIs

JSON

XML

Syslog

TLS

Job description

Fortinet Inc. is seeking a software engineer to join the FortiSIEM Advanced Threat Integration team. You will develop production code and tooling, while understanding how security telemetry is normalized into reliable detections.

The role sits at the boundary of software engineering, data parsing, and detection engineering, with collaboration across teams and a focus on high-quality, scalable content.