Sr Applications Security Engineer

Fortinet is seeking a Sr Applications Security Engineer to join its Corporate Information Security team. Based in Sunnyvale, CA, this onsite role focuses on improving the security of Fortinet applications throughout the development lifecycle, from security reviews and vulnerability mitigation to static and dynamic application security testing.

In this position, you will act as an application security subject matter expert, working with development partners to strengthen secure design, review code and architecture, and address both internal and externally reported vulnerabilities. You will also contribute to security testing programs and help shape tools, processes, and controls that support security and privacy by design.

What you’ll do

• Serve as an application security subject matter expert and provide guidance to internal teams
• Partner with development teams on code reviews, penetration tests, and architectural reviews for existing code and new features
• Develop, implement, and communicate vulnerability mitigation strategies to development teams
• Support the Corporate Information Security Responsible Disclosure Program committee by handling externally reported vulnerabilities
• Drive Fortinet’s static and dynamic application security testing program
• Design and implement tools, processes, and controls to ensure security and privacy are built into Fortinet applications
• Advise teams on SDLC best practices
• Research new application attack vectors that could impact Fortinet applications and infrastructure
• Work within a global distributed team by sharing knowledge, coordinating workload, and assigning tasks; coach peers on application security concepts and best practices

What you’ll need

• 5+ years of work experience as an Information Security Researcher or Engineer
• 3+ years manually auditing source code to find security issues, or strong programming skills using Java, .NET, Python, or JavaScript frameworks
• Strong understanding of OWASP TOP 10 vulnerabilities
• Strong understanding of common API security risks
• Strong understanding of cloud-native application architecture, microservices, containerization, and secure deployment and implementation issues
• Proven experience in application penetration testing
• Proven experience in security code review
• Proven experience with application security testing tools and processes including DAST, SAST, IAST, and SCA
• Strong foundation in computer and network security, authentication and authorization, security protocols, and applied cryptography
• Solid understanding of web security standards such as CSP, SOP, CORS, and emerging web security technologies
• Solid understanding of CI/CD pipelines, build systems, and DevSecOps principles
• Strong understanding of AI & ML and LLM concepts including RAG, Agentic Workflows, MCPs, AI Red Teaming, AI Guardrails, and secure AI development and deployment strategies
• Experience defining security architecture patterns and standards in a large enterprise organization
• Experience with cloud-based security solutions and familiarity with cloud service providers, especially in relation to application security
• Experience using threat modeling methodologies such as MITRE ATT&CK, STRIDE, and PASTA
• Understanding of OAuth and JWT implementations
• Ability to organize and communicate effectively in both written and verbal forms with technical and non-technical stakeholders across functional teams
• A BS degree in Computer Science, Cyber Security, another tech-related degree, or equivalent experience
• Plus: Experience with Cloud Security Posture Management (CSPM) and/or Application Security Posture Management (ASPM) tools
• Plus: OSWE, OSCP, GWEB, GPEN, or similar certifications
• Plus: Experience in Mobile Application Penetration Testing

Salary

• USD 147,000 - 180,000 per yearly

Technologies you may work with

• Java, .NET, Python, JavaScript frameworks
• OWASP TOP 10
• DAST, SAST, IAST, SCA
• CSP, SOP, CORS
• CI/CD pipelines, DevSecOps
• RAG, Agentic Workflows, MCPs
• AI Red Teaming, AI Guardrails
• MITRE ATT&CK, STRIDE, PASTA
• OAuth, JWT
• Cloud Security Posture Management (CSPM), Application Security Posture Management (ASPM)
• OSWE, OSCP, GWEB, GPEN
• Microservices, containerization technologies, SDLC
• Authentication & authorization, applied cryptography
• Cloud-native application architecture

Benefits

• Medical, dental, vision, life and disability insurance
• 401(k)
• 11 paid holidays
• Vacation time
• Sick time
• Comprehensive leave program
• Participate in the Fortinet equity program