Staff Applications Security Engineer

Fortinet•Sunnyvale, CA

About The Position

Fortinet is seeking a Staff Applications Security Engineer to join its Corporate Information Security team. This highly technical role conducts security reviews of Fortinet applications, educates engineers on security, and handles externally reported vulnerabilities. The engineer serves as an application security subject matter expert, partners with development teams, and helps ensure security and privacy are incorporated into Fortinet applications.

Requirements

At least 5 years of work experience as an Information Security Researcher or Engineer.
At least 3 years of experience manually auditing source code for security issues or programming in one or more of Java, .NET, Python, or JavaScript frameworks.
Strong understanding of OWASP Top 10 vulnerabilities and common API security risks.
Strong understanding of cloud-native application architecture, microservices, containerization technologies, and secure deployment and implementation issues.
Proven experience in application penetration testing, security code review, and application security testing tools and processes, including DAST, SAST, IAST, and SCA.
Strong foundation in computer and network security, authentication and authorization, security protocols, and applied cryptography.
Solid understanding of web security standards and technologies, including CSP, SOP, and CORS.
Solid understanding of CI/CD pipelines, build systems, and DevSecOps principles.
Strong understanding of AI, ML, and LLM concepts, including RAG, agentic workflows, MCPs, skills, AI red teaming, AI guardrails, and secure AI development and deployment strategies.
Experience defining security architecture patterns and standards in a large enterprise organization.
Experience with cloud-based security solutions and familiarity with cloud service providers, particularly regarding application security.
Experience with threat modeling methodologies such as MITRE ATT&CK, STRIDE, and PASTA.
Understanding of OAuth and JWT implementations.
Ability to organize and communicate effectively, in writing and verbally, with technical and non-technical people across functional teams.
A BS degree in Computer Science, Cyber Security, another technology-related field, or equivalent experience.
Must be authorized to work in the U.S. without sponsorship.

Nice To Haves

Experience with Cloud Security Posture Management (CSPM) and/or Application Security Posture Management (ASPM) tools.
OSWE, OSCP, GWEB, GPEN, or a similar certification.
Experience in mobile application penetration testing.

Responsibilities

Provide application security guidance to internal teams as a subject matter expert.
Work with development teams to conduct code reviews, penetration tests, and architectural reviews of existing code and new features.
Develop, implement, and communicate vulnerability mitigation strategies to development teams.
Handle externally reported vulnerabilities as a member of the Corporate Information Security Responsible Disclosure Program committee.
Drive Fortinet’s static and dynamic application security testing program.
Develop strategies, evaluate solutions, and design and implement tools, processes, and controls to build security and privacy into Fortinet applications.
Advise development teams on SDLC best practices.
Research new application attack vectors that could affect Fortinet applications and infrastructure.
Collaborate with a global distributed team to share knowledge, workload, and assignments.
Coach peers in application security concepts and best practices.