Sr Applications Security Engineer

Fortinet’s Corporate Information Security team is hiring a Sr Applications Security Engineer in Sunnyvale, CA (onsite). This role centers on strengthening security across Fortinet applications by combining security reviews, vulnerability mitigation, and hands-on testing across the SDLC. You will help guide development teams, drive static and dynamic application security testing at scale, and contribute to coordinated handling of externally reported vulnerabilities.

What you’ll do

• Act as an application security subject matter expert, providing guidance to internal teams
• Collaborate with development teams to perform code reviews, penetration tests, and architectural reviews for existing code and new features
• Develop, implement, and communicate vulnerability mitigation strategies to development teams
• Support externally reported vulnerabilities as part of the Corporate Information Security Responsible Disclosure Program committee
• Drive Fortinet’s static and dynamic application security testing program
• Create strategies and evaluate solutions to design and implement tools, processes, and controls that support security and privacy in Fortinet applications
• Advise teams on SDLC best practices
• Proactively research new application attack vectors affecting Fortinet applications and infrastructure
• Work within a global distributed team to share knowledge, manage workload, and coach peers in application security concepts and best practices

What you bring

• 5+ years of work experience as an Information Security Researcher or Engineer
• 3+ years manually auditing source code to find security issues, with programming skills in one or more of Java, .NET, Python, or JavaScript frameworks
• Strong understanding of OWASP TOP 10 vulnerabilities
• Strong understanding of common API security risks
• Strong understanding of cloud-native application architecture, microservices, containerization, and secure deployment/implementation issues
• Proven experience in application penetration testing, security code review, and application security testing using DAST, SAST, IAST, and SCA
• Strong foundation in computer and network security, authentication & authorization, security protocols, and applied cryptography
• Solid understanding of web security standards such as CSP, SOP, CORS, and emerging web security technologies
• Solid understanding of CI/CD pipelines, build systems, and DevSecOps principles
• Strong understanding of AI&ML and LLM concepts including RAG, Agentic Workflows, MCPs, Skills, AI Red Teaming, and AI Guardrails, plus secure AI development and deployment strategies
• Experience defining security architecture patterns and standards in a large enterprise organization
• Experience with cloud-based security solutions and familiarity with cloud service providers for application security
• Experience with threat modeling methodologies such as MITRE ATT&CK, STRIDE, and PASTA
• Understanding of OAuth and JWT implementations
• Ability to organize and communicate effectively, written and verbal, with technical and non-technical stakeholders
• BS degree in Computer Science, Cyber Security, other tech-related degree, or equivalent experience
• Plus: Experience with Cloud Security Posture Management (CSPM) and/or Application Security Posture Management (ASPM) tools
• Plus: OSWE, OSCP, GWEB, GPEN, or similar certificate
• Plus: Experience in Mobile Application Penetration Testing

Compensation

USD 147,000 - 180,000 per year.

Benefits

• Medical, dental, vision, life and disability insurance
• 401(k)
• 11 paid holidays
• Vacation time
• Sick time
• Comprehensive leave program
• Participation in the Fortinet equity program