Software Engineer – FortiSIEM Threat Detection & Integration

Fortinet•Sunnyvale, CA

9d•$123,000 - $151,000

About The Position

The Software Engineer will join Fortinet’s FortiSIEM Advanced Threat Integration engineering team. The role combines hands-on software development with security detection engineering, working with security telemetry, parsers, integrations, detections, and supporting code and tooling to deliver reliable FortiSIEM content. The engineer will analyze and normalize logs from Fortinet and third-party products; develop and maintain parsers, security rules, reports, dashboards, integrations, and tools; and test and troubleshoot this content using representative samples. The position involves working in Linux and Git/GitLab environments and collaborating with developers, QA, support, and security researchers to review, validate, and release FortiSIEM content. It is a production software engineering role at the boundary of data parsing and integration and detection engineering, rather than a pure security-analyst or generic application-development role. Applicants must be authorized to work in the U.S. without sponsorship.

Requirements

Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.
At least 3 years of software engineering experience with a bachelor’s degree, or at least 2 years with a master’s degree.
Strong Python programming skills, including data structures, file and network I/O, error handling, testing, and debugging.
Strong regular-expression skills and ability to reason about correctness and performance when parsing untrusted or irregular log data.
Solid understanding of algorithms, data structures, complexity, object-oriented design, and concurrent or asynchronous execution where applicable.
Good working knowledge of Linux, including processes, files, permissions, networking basics, command-line troubleshooting, and shell scripting.
Working knowledge of Git/GitLab and collaborative code-review workflows.
Ability to interpret unfamiliar logs, APIs, schemas, and vendor documentation and convert them into deterministic software and detection logic.
Strong debugging and problem-solving ability, with attention to edge cases and reproducible testing.
Ability to work effectively in a distributed engineering team and communicate technical reasoning clearly.
Must be authorized to work in the U.S. without sponsorship.

Nice To Haves

Experience with SIEM, security analytics, log management, EDR, firewall, identity, cloud, or other security telemetry.
Understanding of security event concepts such as source/destination identity, authentication events, process execution, network activity, vulnerabilities, and security-product actions.
Familiarity with detection engineering concepts such as false positives, detection coverage, correlation, baselining, thresholds, and MITRE ATT&CK.
Prior experience developing SIEM parsers, correlation rules, Sigma-style detections, or security-content packages.
Working knowledge of C++ for lower-level or performance-sensitive components.
Experience with REST APIs, JSON, XML, syslog, TLS, sockets, and common authentication mechanisms.
Experience with distributed or high-throughput event-processing systems.
Experience with at least one public cloud platform (AWS, Azure, or GCP).
Experience building developer tooling, automated test harnesses, or CI/CD checks for data/content pipelines.

Responsibilities

Analyze raw security and audit logs from Fortinet and third-party products to understand their structure and important fields.
Build and maintain FortiSIEM log parsers that extract and normalize data into standard event attributes.
Create and update FortiSIEM security rules, reports, dashboards, and related detection content.
Research vendor documentation, advisories, and sample logs to support new integrations and detections.
Develop and maintain lightweight integrations and supporting tools using Python, regular expressions, APIs, and basic scripting.
Test and troubleshoot parsers, rules, and integrations using representative log samples and expected results.
Work in Linux environments and use Git/GitLab for source control, code review, and team development.
Collaborate with developers, QA, support, and security researchers to review, validate, and release FortiSIEM content.