Principal Software Dev QA Engineer

Fortinet • Sunnyvale, CA

1d

About The Position

Fortinet is hiring a Principal QA Engineer for its AI security product line. This hands-on role owns end-to-end testing of an AI-powered penetration testing product across SaaS and on-premises deployments, combining test automation, offensive security expertise, and AI evaluation. The Principal QA Engineer sets quality strategy and release criteria to ensure assessments run safely and produce accurate, verifiable findings.

Requirements

• 8+ years in software QA, test automation, or security engineering, including ownership of test strategy and release qualification for complex products.
• Hands-on penetration testing experience, including the ability to reproduce vulnerabilities and independently verify findings.
• Experience testing SaaS and on-premises products, including multi-tenancy, deployment, upgrades, and failure recovery.
• Strong Python or equivalent programming skills, with experience building API and system test automation.
• Solid knowledge of networking, Linux, Windows, authentication, and authorization; experience troubleshooting distributed services using logs, metrics, and network captures.
• Experience with a major cloud platform, Docker, Kubernetes, and performance or load testing.
• Working knowledge of LLMs and autonomous agents, including tool calling and evaluation of variable outputs.
• Strong technical judgment and communication skills, including the ability to turn incomplete requirements into test coverage and explain release risks.
• Must be able to work in the US without sponsorship.

Nice To Haves

• Experience with autonomous pentesting, vulnerability management, or security validation products; familiarity with the Fortinet ecosystem.
• Knowledge of Active Directory, cloud IAM, MITRE ATT&CK, and OWASP testing methods; practical use of Burp Suite, Nmap, Metasploit, or BloodHound.
• Experience with AI evaluation datasets, adversarial testing, infrastructure as code, or automated security labs.
• OSCP, OSWE, GPEN, or comparable offensive security expertise.

Responsibilities

• Lead testing across discovery, attack planning and execution, reporting, and remediation verification, covering the user interface, APIs, agents, and backend services.
• Build controlled security labs with known vulnerabilities and attack paths; verify exploitation evidence, false positives, false negatives, severity, and remediation guidance.
• Evaluate AI planning and tool use, repeatability, model failures, and resistance to prompt injection; detect regressions caused by model, prompt, and tool changes.
• Validate assessment safety, including scope enforcement, credential protection, execution limits, stop controls, and cleanup.
• Test SaaS tenant isolation, provisioning, permissions, usage metering, and license enforcement; qualify on-premises installation, upgrades, rollback, and restricted connectivity.
• Assess performance, scaling, and recovery during concurrent assessments, service failures, and network interruptions; verify result integrity and resume behavior.
• Build automation and CI/CD regression suites; automate testbed provisioning, reset, and evidence collection.
• Partner with Engineering, Product Management, and Operations on defect resolution and release gating; guide test reviews and mentor QA engineers.

Benefits

• Medical, dental, and vision insurance
• Life and disability insurance
• 401(k)
• 11 paid holidays
• Vacation time
• Sick time
• Comprehensive leave program
• Eligibility to participate in the Fortinet equity program
• Bonus eligibility reviewed at hire and annually at the company's discretion

What This Job Offers

• Job Type: Full-time
• Career Level: Principal
• Education Level: No Education Listed