About this role
Salary: £50,000 - 82,000 per year
Requirements: We require 5+ years of work experience as an Information Security Researcher or Engineer.We require 3+ years of experience manually auditing source code to find security issues or programming skills in one or more of Java, .NET, Python, or JavaScript frameworks.We require a strong understanding of OWASP Top 10 vulnerabilities.We require a strong understanding of common API security risks.We require a strong understanding of cloud-native application architecture, microservices, containerization technologies, secure deployment, and implementation issues.We require proven experience in application penetration testing.We require proven experience in security code review.We require proven experience with application security testing tools and processes, including DAST, SAST, IAST, and SCA.We require a strong foundation in computer and network security, authentication and authorization, security protocols, and applied cryptography.We require a solid understanding of web security standards such as CSP, SOP, CORS, and emerging web security technologies.We require a solid understanding of CI/CD pipelines, build systems, and DevSecOps principles.We require experience defining security architecture patterns and standards in a large enterprise organization.We require experience with cloud-based security solutions and familiarity with cloud service providers, particularly in relation to application security.We require experience with threat modeling methodologies such as MITRE ATT&CK, STRIDE, and PASTA.We require proficiency with web proxies such as Burp, OWASP ZAP, or Fiddler.We require an understanding of OAuth and JWT implementations.We require the ability to organize and communicate effectively, both written and verbal, with technical and non-technical people across functional teams.We require a BS degree in Computer Science, Cyber Security, another tech-related degree, or equivalent experience. Responsibilities: We serve as an application security subject matter expert who provides guidance to internal teams.We work closely with development teams and perform code reviews, penetration tests, and architectural reviews on existing code and new features.We develop, implement, and communicate vulnerability mitigation strategies to development teams.We handle externally reported vulnerabilities as a member of our Corporate Information Security Responsible Disclosure Program committee.We drive our static and dynamic application security testing program.We develop strategies, evaluate solutions, and design and implement tools, processes, and controls to ensure security and privacy are designed into our applications.We advise development teams on SDLC best practices.We proactively research new attack vectors on applications that may affect our applications and infrastructure.We share knowledge, workload, and assignments as part of a global distributed team.We coach peers in application security concepts and best practices. Technologies: APICI/CDCloudCryptographyDevSecOpsFabricFiddlerSupportJWTJavaJavaScriptNetworkOWASPOAuthPythonSecurityWebmicroservicesASP.NETAILLMMobile More:
Fortinet is looking for a Senior Application Security Engineer to join our Corporate Information Security team in a highly technical, hybrid role. We protect people, devices, and data everywhere through our mission to secure the digital world, and our Security Fabric platform delivers broad, integrated, and automated protection across the entire attack surface, from the data center to the cloud to the home office. More than 615,000 customers trust us, including many of the worlds largest enterprises, service providers, and government organizations. We also support cyber training and career opportunities through our Fortinet NSE Training Institute. This is a full-time posting.
last updated 36 week of 2026