Senior Applications Security Engineer

Fortinet

Confirmed live today High trust
Hybrid

Quick summary

Work type
Hybrid
Location
Sunnyvale, CA
Salary
$170,000–$240,000 / yr
Employment
Full-time
Posted
4 days ago
Freshness
Confirmed live today

Market check

Salary context

Above market

How this pay compares to similar roles

Similar $183k
This role $205k
$123k $253k
below market most similar roles pay here above market

This role pays more than 68% of similar roles. Most pay $150,862–$216,000 — the blue band above. At the midpoint, this role pays about $205k versus about $183k for comparable roles.

Based on 240 similar postings.

Employer

About Fortinet

Fortinet is a US-based cybersecurity company best known for its FortiGate next-generation firewalls. It sells a broad security platform spanning network security, SD-WAN, endpoint protection, cloud security, and SIEM/SOC operations.

Fortinet currently has 102 open roles on FindRole.

Listed pay typically runs $140,000–$183,000 across 77 roles with salary data.

Most-posted roles

View all roles at Fortinet

At a glance

TL;DR · Senior Applications Security Engineer

The Sr Applications Security Engineer joins the Corporate Information Security team as a technical subject matter expert. This role involves conducting security reviews, performing manual source code audits, and executing penetration tests on existing code and new features. The engineer will develop vulnerability mitigation strategies, drive static and dynamic application security testing programs, and advise development teams on SDLC best practices. Key technical requirements include proficiency in Java, .NET, Python, or JavaScript frameworks, alongside knowledge of OWASP Top 10, API security, and cloud-native architectures including microservices and containerization. The position requires expertise in DAST, SAST, IAST, and SCA tools, as well as AI/ML concepts like RAG and AI Red Teaming. The work focuses on securing applications through threat modeling methodologies like STRIDE and PASTA.

What you'll do

  • Perform security code reviews, penetration tests, and architectural reviews on new and existing features.
  • Develop and communicate vulnerability mitigation strategies to internal development teams.
  • Manage externally reported vulnerabilities as a member of the Responsible Disclosure Program committee.
  • Drive the company's static and dynamic application security testing (SAST/DAST) programs.
  • Design and implement tools, processes, and controls to ensure security and privacy are built into applications.
  • Advise development teams on secure SDLC best practices and security architecture patterns.
  • Research new attack vectors that may impact corporate applications and infrastructure.
  • Coach peers on application security concepts and provide guidance as a subject matter expert.

What we're looking for

  • A BS degree in Computer Science, Cyber Security, another tech-related degree, or equivalent experience.
  • 5+ years of work experience as an Information Security Researcher or Engineer.
  • 3+ years of experience manually auditing source code or programming in Java, .NET, Python, or JavaScript frameworks.
  • Proven experience in application penetration testing, security code review, and DAST, SAST, IAST, and SCA tools.
  • Strong understanding of OWASP Top 10, API security, Cloud-Native architecture, and web security standards like CSP, SOP, and CORS.
  • Strong understanding of AI/ML and LLM concepts including RAG, AI Red Teaming, and secure AI development strategies.
  • Experience with threat modeling (MITRE ATT&CK, STRIDE, PASTA), CI/CD pipelines, and DevSecOps principles.
  • Experience in CSPM, ASPM, or Mobile Application Penetration Testing (preferred).
  • OSWE, OSCP, GWEB, or GPEN certification (preferred).

More like this

Similar roles

Senior Application Security Engineer

LPL Financial

Fort Mill, SC +5 78 days ago
Application Security DevSecOps CI/CD OWASP Top 10 IAST Burpsuite Postman Synopsys BlackDuck PrismaCloud Java C# React Angular HTML CSS REST Containers APIs
5+ yrs exp Hybrid

Application Security Engineer

Booz Allen Hamilton

Washington, DC 14 days ago $62,000–$141,000
SAST DAST Threat Modeling Burp Suite Veracode Java Python .NET C# Linux UNIX OWASP NIST 800-53 FIPS FedRAMP IAST Eclipse JDeveloper
6+ yrs exp

Application Security Engineer

Booz Allen Hamilton

Annapolis Junction, MD +1 39 days ago $69,400–$158,000
SAST DAST SCA DevSecOps Secure SDLC Container Security Cloud Security Vulnerability Management OWASP SAMM BSIMM NIST SSDF NIST CSF ISO 27001 MITRE ATT&CK ISO/IEC 42001 IEC 62443
2+ yrs exp

Application Security Engineer

State Street

Quincy, MA +4 60 days ago
DevSecOps AppSec CI/CD SAST DAST SCA Python Java .Net Node.js AWS Azure Kubernetes Terraform Ansible Infrastructure as Code Agile API Security Container Security SSDLC
6+ yrs exp

Senior Application Security Engineer

Arch Capital Group

Farmington, CT 14 days ago $127,000–$172,000
Application Security SAST DAST SCA CI/CD DevSecOps AWS Azure Containers Serverless Threat Modeling NIST OWASP MITRE SDLC Vulnerability Management
5+ yrs exp Hybrid