9 hours ago
Sunnyvale, CA, USASenior
Base Salary
$147k - $180k/yr
Responsibilities
- Provide application security subject-matter expertise and guidance to internal development teams.
- Conduct source-code reviews, application penetration tests, security assessments, and architectural reviews.
- Develop and communicate vulnerability mitigation strategies.
- Manage externally reported vulnerabilities through Fortinet’s Responsible Disclosure Program committee.
- Drive static, dynamic, interactive, and software composition application security testing programs.
- Design and implement application security and privacy tools, processes, controls, architecture patterns, and standards.
- Advise teams on secure SDLC practices, cloud-native security, AI security, and secure deployment.
- Research emerging application attack vectors and coach peers on application security concepts and best practices.
Requirements
- At least 5 years of experience as an Information Security Researcher or Engineer.
- At least 3 years of manually auditing source code for security issues or programming with Java, .NET, Python, or JavaScript frameworks.
- Strong understanding of OWASP Top 10 vulnerabilities, API security risks, cloud-native architectures, containerization, authentication and authorization, cryptography, and web security standards.
- Proven application penetration testing, security code review, and application security testing experience involving DAST, SAST, IAST, and SCA tools and processes.
- Experience with security architecture patterns and standards in a large enterprise organization and with cloud-based security solutions.
- Experience with threat modeling methodologies including MITRE ATT&CK, STRIDE, and PASTA.
- Understanding of OAuth and JWT implementations, CI/CD pipelines, build systems, and DevSecOps principles.
- Understanding of AI, ML, and LLM security concepts including RAG, agentic workflows, MCPs, AI red teaming, AI guardrails, and secure AI development and deployment.
- Bachelor’s degree in Computer Science, Cyber Security, or another technology-related field, or equivalent experience.
- Experience with CSPM or ASPM tools, OSWE, OSCP, GWEB, GPEN, or similar certifications, and mobile application penetration testing are preferred.
Benefits
- Medical, dental, vision, life, and disability insurance.
- 401(k), 11 paid holidays, vacation time, sick time, and a comprehensive leave program.
- Eligibility to participate in Fortinet’s equity program and potential bonus eligibility.
- Full-time position with a stated U.S. base salary range of $147,000-$180,000.
Tech Stack
Categories
About Fortinet
Fortinet is a public cybersecurity company that builds network security hardware and software for enterprises, service providers, and governments. Its FortiGate firewalls, secure networking (SD-WAN), endpoint and cloud security, and threat intelligence subscriptions are sold via direct and channel partners. Founded in 2000 and headquartered in Sunnyvale, California, Fortinet trades on NASDAQ (FTNT) and serves more than 660,000 customers worldwide.