Staff Applications Security Engineer

Fortinet

. Serve as an application security subject matter expert and provide guidance to internal teams .

Posted 11/7/2026full-timeSunnyvale • California • United StatesLead💰 $170,000 - $240,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in application security, including vulnerability mitigation strategies, security code reviews, and penetration testing. Proficient in cloud-native application architecture and security best practices, with a strong foundation in computer and network security.

Highest-signal resume keywords

Application Security TestingPenetration TestingSecurity Code ReviewOWASP TOP 10 VulnerabilitiesCloud-Native Application Architecture

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

JavaC#PythonJavaScriptDASTSASTIASTSCAThreat ModelingSecurity Protocols

Soft Skills

Effective CommunicationCoaching

Tools & Technologies

CI/CD PipelinesDevSecOpsCSPMASPMCloud Security Solutions

Certifications & Qualifications

OSWEOSCPGWEBGPEN

Industry Keywords

Application SecurityVulnerability MitigationMicroservicesContainerizationAPI Security Risks

Tech Stack

Tools & technologies

CloudCyber SecurityJavaJavaScriptMicroservicesPythonSDLC.NET

About the role

Key responsibilities & impact

Serve as an application security subject matter expert and provide guidance to internal teams
Work with development teams on code reviews, penetration tests, and architectural reviews of existing code and new features
Develop, implement, and communicate vulnerability mitigation strategies
Handle externally reported vulnerabilities as a member of the Corporate Information Security Responsible Disclosure Program committee
Drive Fortinet’s static and dynamic application security testing program
Develop strategies, evaluate solutions, and design and implement tools, processes, and controls embedding security and privacy into Fortinet applications
Advise development teams on SDLC best practices
Research new application attack vectors affecting Fortinet applications and infrastructure
Collaborate within a global distributed team to share knowledge, workload, and assignments
Coach peers on application security concepts and best practices

Requirements

What you’ll need

5+ years of work experience as an Information Security Researcher or Engineer
3+ years of experience manually auditing source code to find security issues or programming in Java, .NET, Python, or JavaScript frameworks
Strong understanding of OWASP TOP 10 vulnerabilities
Strong understanding of common API security risks
Strong understanding of cloud-native application architecture, microservices, containerization technologies, secure deployment, and implementation issues
Proven experience in application penetration testing
Proven experience in security code review
Proven experience with application security testing tools and processes: DAST, SAST, IAST, and SCA
Strong foundation in computer and network security, authentication and authorization, security protocols, and applied cryptography
Solid understanding of web security standards including CSP, SOP, CORS, and emerging web security technologies
Solid understanding of CI/CD pipelines, build systems, and DevSecOps principles
Strong understanding of AI/ML and LLM concepts including RAG, Agentic Workflows, MCPs, Skills, AI Red Teaming, AI Guardrails, and secure AI development and deployment strategies
Experience defining security architecture patterns and standards in a large enterprise organization
Experience with cloud-based security solutions and familiarity with cloud service providers, particularly for application security
Experience with threat modeling methodologies such as MITRE ATT&CK, STRIDE, and PASTA
Understanding of OAuth and JWT implementations
Ability to communicate effectively, in writing and verbally, with technical and non-technical people across functional teams
BS degree in Computer Science, Cyber Security, another technology-related field, or equivalent experience
Must be authorized to work in the U.S. without sponsorship
Experience with CSPM and/or ASPM tools is a plus
OSWE, OSCP, GWEB, GPEN, or similar certification is a plus
Experience in mobile application penetration testing is a plus

Benefits

Comp & perks

Medical insurance
Dental insurance
Vision insurance
Life insurance
Disability insurance
401(k)
11 paid holidays
Vacation time
Sick time
Comprehensive leave program
Equity program
Bonus eligibility
Supportive work environment
Competitive Total Rewards package
Reasonable accommodations for qualified individuals with disabilities