Sr Applications Security Engineer

Fortinet • Sunnyvale, CA

1d

About The Position

Fortinet is seeking a Senior Applications Security Engineer to join its Corporate Information Security team. This highly technical role conducts security reviews of Fortinet applications, educates engineers on security, and handles externally reported vulnerabilities. The engineer will work with development teams and a global distributed security team to strengthen application security and privacy throughout the development lifecycle.

Requirements

• At least 5 years of work experience as an Information Security Researcher or Engineer.
• At least 3 years of experience manually auditing source code for security issues or programming in one or more of Java, .NET, Python, or JavaScript frameworks.
• Strong understanding of OWASP Top 10 vulnerabilities and common API security risks.
• Strong understanding of cloud-native application architecture, microservices, containerization technologies, and secure deployment and implementation issues.
• Proven experience in application penetration testing, security code review, and application security testing tools and processes, including DAST, SAST, IAST, and SCA.
• Strong foundation in computer and network security, authentication and authorization, security protocols, and applied cryptography.
• Solid understanding of web security standards and technologies, including CSP, SOP, CORS, and emerging web security technologies.
• Solid understanding of CI/CD pipelines, build systems, and DevSecOps principles.
• Strong understanding of AI, ML, and LLM concepts, including RAG, agentic workflows, MCPs, skills, AI red teaming, AI guardrails, and secure AI development and deployment strategies.
• Experience defining security architecture patterns and standards in a large enterprise organization.
• Experience with cloud-based security solutions and familiarity with cloud service providers, particularly in application security.
• Experience with threat modeling methodologies such as MITRE ATT&CK, STRIDE, or PASTA.
• Understanding of OAuth and JWT implementations.
• Ability to organize and communicate effectively, verbally and in writing, with technical and non-technical people across functional teams.
• A BS degree in Computer Science, Cyber Security, another technology-related field, or equivalent experience.
• Must be authorized to work in the U.S. without sponsorship.

Nice To Haves

• Experience with Cloud Security Posture Management (CSPM) and/or Application Security Posture Management (ASPM) tools.
• OSWE, OSCP, GWEB, GPEN, or a similar certification.
• Experience in mobile application penetration testing.

Responsibilities

• Serve as an application security subject matter expert and provide guidance to internal teams.
• Work with development teams to conduct source-code reviews, penetration tests, and architectural reviews of existing code and new features.
• Develop, implement, and communicate vulnerability mitigation strategies to development teams.
• Handle externally reported vulnerabilities as a member of the Corporate Information Security Responsible Disclosure Program committee.
• Drive Fortinet's static and dynamic application security testing program.
• Develop strategies, evaluate solutions, and design and implement tools, processes, and controls to ensure security and privacy are designed into Fortinet applications.
• Advise development teams on secure SDLC best practices.
• Research new application attack vectors that may affect Fortinet applications and infrastructure.
• Share knowledge, workload, and assignments as part of a global distributed team.
• Coach peers on application security concepts and best practices.

Benefits

• Medical, dental, vision, life, and disability insurance.
• 401(k).
• 11 paid holidays, vacation time, and sick time.
• Comprehensive leave program.
• Eligibility to participate in the Fortinet equity program.
• Bonus eligibility, reviewed at hire and annually at the company's discretion.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior