Software Engineer – FortiSIEM Threat Detection & Integration

Fortinet•Sunnyvale, CA

10d•$123,000 - $151,000

About The Position

Fortinet is seeking a Software Engineer to join the FortiSIEM Advanced Threat Integration engineering team. The role combines hands-on software development with security detection engineering, working with security telemetry ingestion and normalization, parsers and integrations, detection models, and supporting code and tools for reliable FortiSIEM content. The engineer analyzes logs from Fortinet and third-party products, builds and maintains parsers, and develops security rules, reports, dashboards, integrations, and supporting tools. The work includes researching vendor documentation and sample logs, testing and troubleshooting content, and collaborating with developers, QA, support, and security researchers to validate and release it. The position involves production code and tooling as well as understanding how security telemetry should be normalized and turned into reliable detections; it is neither a pure security-analyst nor a generic application-development role. Candidates must be authorized to work in the U.S. without sponsorship. This is a full-time position with a U.S. base salary range of $123,000–$151,000. Fortinet states that exact offers depend on factors including subject knowledge, skills, qualifications, experience, and geographic location. Roles are eligible for the Fortinet equity program; bonus eligibility is reviewed at hire and annually at the company’s discretion.

Requirements

A BS in Computer Science, Computer Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.
At least 3 years of software engineering experience with a BS, or at least 2 years with an MS.
Strong Python programming skills, including data structures, file and network I/O, error handling, testing, and debugging.
Strong regular-expression skills and ability to reason about correctness and performance when parsing untrusted or irregular log data.
Solid understanding of algorithms, data structures, complexity, object-oriented design, and concurrent or asynchronous execution where applicable.
Good working knowledge of Linux, including processes, files, permissions, networking basics, command-line troubleshooting, and shell scripting.
Working knowledge of Git/GitLab and collaborative code-review workflows.
Ability to read unfamiliar logs, APIs, schemas, and vendor documentation and convert them into deterministic software and detection logic.
Strong debugging and problem-solving ability, attention to edge cases, and reproducible testing practices.
Ability to work effectively in a distributed engineering team and communicate technical reasoning clearly.
Authorization to work in the U.S. without sponsorship.

Nice To Haves

Experience with SIEM, security analytics, log management, EDR, firewall, identity, cloud, or other security telemetry is strongly preferred.
Understanding of security event concepts such as source/destination identity, authentication events, process execution, network activity, vulnerabilities, and security-product actions.
Familiarity with detection engineering concepts such as false positives, detection coverage, correlation, baselining, thresholds, and MITRE ATT&CK.
Prior experience developing SIEM parsers, correlation rules, Sigma-style detections, or security-content packages.
Working knowledge of C++ for lower-level or performance-sensitive components.
Experience with REST APIs, JSON, XML, syslog, TLS, sockets, and common authentication mechanisms.
Experience with distributed or high-throughput event-processing systems.
Experience with at least one public cloud platform: AWS, Azure, or GCP.
Experience building developer tooling, automated test harnesses, or CI/CD checks for data/content pipelines.

Responsibilities

Analyze raw security and audit logs from Fortinet and third-party products to understand their structure and important fields.
Build and maintain FortiSIEM log parsers that extract and normalize data into standard event attributes.
Create and update FortiSIEM security rules, reports, dashboards, and related detection content.
Research vendor documentation, advisories, and sample logs to support new integrations and detections.
Develop and maintain lightweight integrations and supporting tools using Python, regular expressions, APIs, and basic scripting.
Test and troubleshoot parsers, rules, and integrations using representative log samples and expected results.
Work in Linux environments and use Git/GitLab for source control, code review, and team development.
Collaborate with developers, QA, support, and security researchers to review, validate, and release FortiSIEM content.