Senior Applications Security Engineer

Fortinet

. Conduct security reviews on Fortinet applications .

Posted 10/14/2026full-timeSunnyvale • California • United StatesSenior💰 $147,000 - $180,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in application security, including vulnerability mitigation strategies, security code reviews, and penetration testing. Proficient in collaborating with development teams to implement secure coding practices and evaluate security solutions.

Highest-signal resume keywords

Application Security TestingVulnerability Mitigation StrategiesPenetration TestingSecurity Code ReviewOWASP TOP 10 Understanding

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

JavaPythonJavaScript.NETApplication Penetration TestingStatic Application Security Testing (SAST)Dynamic Application Security Testing (DAST)Interactive Application Security Testing (IAST)Software Composition Analysis (SCA)Cloud-Native Application Architecture

Soft Skills

Effective CommunicationCoaching

Tools & Technologies

CI/CD PipelinesDevSecOps PrinciplesCloud-Based Security SolutionsCSPM ToolsASPM Tools

Certifications & Qualifications

OSWEOSCPGWEBGPEN

Industry Keywords

OWASPAPI Security RisksThreat ModelingMITRE ATT&CKSecurity Protocols

Tech Stack

Tools & technologies

CloudCyber SecurityJavaJavaScriptMicroservicesPythonSDLC.NET

About the role

Key responsibilities & impact

Conduct security reviews on Fortinet applications
Provide security education and guidance to engineers and internal teams
Serve as an application security subject matter expert
Collaborate with development teams on code reviews, penetration tests, and architectural reviews
Develop, implement, and communicate vulnerability mitigation strategies
Handle externally reported vulnerabilities through Fortinet's Responsible Disclosure Program committee
Drive Fortinet's static and dynamic application security testing program
Develop strategies, evaluate solutions, and design and implement tools, processes, and controls for secure and privacy-conscious applications
Advise development teams on SDLC best practices
Research new application attack vectors affecting Fortinet applications and infrastructure
Share knowledge, workload, and assignments as part of a global distributed team
Coach peers on application security concepts and best practices

Requirements

What you’ll need

5+ years of work experience as an Information Security Researcher or Engineer
3+ years of experience manually auditing source code to find security issues or programming in Java, .NET, Python, or JavaScript frameworks
Strong understanding of OWASP TOP 10 vulnerabilities
Strong understanding of common API security risks
Strong understanding of cloud-native application architecture, microservices, containerization technologies, secure deployment, and implementation issues
Proven experience in application penetration testing
Proven experience in security code review
Proven experience with application security testing tools and processes: DAST, SAST, IAST, and SCA
Strong foundation in computer and network security, authentication and authorization, security protocols, and applied cryptography
Solid understanding of web security standards including CSP, SOP, CORS, and emerging web security technologies
Solid understanding of CI/CD pipelines, build systems, and DevSecOps principles
Strong understanding of AI/ML and LLM concepts including RAG, Agentic Workflows, MCPs, Skills, AI Red Teaming, AI Guardrails, and secure AI development and deployment strategies
Experience defining security architecture patterns and standards in a large enterprise organization
Experience with cloud-based security solutions and familiarity with cloud service providers, particularly for application security
Experience with threat modeling methodologies such as MITRE ATT&CK, STRIDE, and PASTA
Understanding of OAuth and JWT implementations
Ability to communicate effectively, both written and verbal, with technical and non-technical people across functional teams
A BS degree in Computer Science, Cyber Security, another technology-related field, or equivalent experience
Experience with CSPM and/or ASPM tools is a plus
OSWE, OSCP, GWEB, GPEN, or similar certification is a plus
Experience in mobile application penetration testing is a plus
Must be authorized to work in the U.S. without sponsorship

Benefits

Comp & perks

Medical insurance
Dental insurance
Vision insurance
Life insurance
Disability insurance
401(k)
11 paid holidays
Vacation time
Sick time
Comprehensive leave program
Equity program
Bonus eligibility
Supportive work environment
Competitive Total Rewards package
Reasonable accommodations for qualified individuals with disabilities