Principal Software Dev QA Engineer

Fortinet•Sunnyvale, CA

2d•$200,000 - $310,000

About The Position

Fortinet is hiring a Principal QA Engineer for its AI security product line to own end-to-end testing of an AI-powered penetration testing product across SaaS and on-premises deployments. This hands-on role combines test automation, offensive security expertise, and AI evaluation. The engineer will set quality strategy and release criteria to ensure assessments run safely and produce accurate, verifiable findings. The role involves leading testing across the product lifecycle, building controlled security labs, evaluating AI behavior, validating assessment safety, qualifying SaaS and on-premises functionality, and testing performance and recovery. The engineer will build automation and CI/CD regression suites, partner with Engineering, Product Management, and Operations on defects and release gating, guide test reviews, and mentor QA engineers. Fortinet offers medical, dental, vision, life and disability insurance, a 401(k), 11 paid holidays, vacation and sick time, and a comprehensive leave program. The expected earnings range is $200,000–$310,000. All roles are eligible to participate in the Fortinet equity program; bonus eligibility is reviewed at hire and annually at the Company’s discretion.

Requirements

8+ years in software QA, test automation, or security engineering, including ownership of test strategy and release qualification for complex products.
Hands-on penetration testing experience, with the ability to reproduce vulnerabilities and independently verify findings.
Experience testing SaaS and on-premises products, including multi-tenancy, deployment, upgrades, and failure recovery.
Strong Python or equivalent programming skills, with experience building API and system test automation.
Solid networking, Linux, Windows, authentication, and authorization knowledge; experience troubleshooting distributed services using logs, metrics, and network captures.
Experience with a major cloud platform, Docker, Kubernetes, and performance or load testing.
Working knowledge of LLMs and autonomous agents, including tool calling and evaluation of variable outputs.
Strong technical judgment and communication; ability to turn incomplete requirements into test coverage and explain release risks.
Must be able to work in the US without sponsorship.

Nice To Haves

Experience with autonomous pentesting, vulnerability management, or security validation products; familiarity with the Fortinet ecosystem.
Knowledge of Active Directory, cloud IAM, MITRE ATT&CK, and OWASP testing methods; practical use of Burp Suite, Nmap, Metasploit, or BloodHound.
Experience with AI evaluation datasets, adversarial testing, infrastructure as code, or automated security labs.
OSCP, OSWE, GPEN, or comparable offensive security expertise.

Responsibilities

Lead testing across discovery, attack planning and execution, reporting, and remediation verification, covering UI, APIs, agents, and backend services.
Build controlled security labs with known vulnerabilities and attack paths; verify exploitation evidence, false positives, false negatives, severity, and remediation guidance.
Evaluate AI planning and tool use, repeatability, model failures, and resistance to prompt injection; detect regressions from model, prompt, and tool changes.
Validate assessment safety, including scope enforcement, credential protection, execution limits, stop controls, and cleanup.
Test SaaS tenant isolation, provisioning, permissions, usage metering, and license enforcement; qualify on-premises installation, upgrades, rollback, and restricted connectivity.
Assess performance, scaling, and recovery during concurrent assessments, service failures, and network interruptions; verify result integrity and resume behavior.
Build automation and CI/CD regression suites; automate testbed provisioning, reset, and evidence collection.
Partner with Engineering, Product Management, and Operations on defect resolution and release gating; guide test reviews and mentor QA engineers.