About this role
Fortinet makes possible a digital world that we can always trust through its mission to protect people, devices, and data everywhere. This is why the world’s largest enterprises, service providers, and government organizations choose Fortinet to securely accelerate their digital journey. The Fortinet Security Fabric platform delivers broad, integrated, and automated protections across the entire digital attack surface, securing critical devices, data, applications, and connections from the data center to the cloud to the home office.
Ranking #1 in the most security appliances shipped worldwide, more than 615,000 customers trust Fortinet to protect their businesses. And the Fortinet NSE Training Institute, an initiative of Fortinet’s Training Advancement Agenda (TAA), provides one of the largest and broadest training programs in the industry to make cyber training and new career opportunities available to everyone.
We are hiring a Principal QA Engineer for Fortinet’s AI security product line to own end-to-end testing of our AI-powered penetration testing product across SaaS and on-premises deployments.
This hands-on role combines test automation, offensive security expertise, and AI evaluation. You will set the quality strategy and release criteria, ensuring assessments run safely and produce accurate, verifiable findings.
Responsibilities
- Lead testing across discovery, attack planning and execution, reporting, and remediation verification, covering UI, APIs, agents, and backend services.
- Build controlled security labs with known vulnerabilities and attack paths; verify exploitation evidence, false positives, false negatives, severity, and remediation guidance.
- Evaluate AI planning and tool use, repeatability, model failures, and resistance to prompt injection; detect regressions from model, prompt, and tool changes.
- Validate assessment safety, including scope enforcement, credential protection, execution limits, stop controls, and cleanup.
- Test SaaS tenant isolation, provisioning, permissions, usage metering, and license enforcement; qualify on-premises installation, upgrades, rollback, and restricted connectivity.
- Assess performance, scaling, and recovery during concurrent assessments, service failures, and network interruptions; verify result integrity and resume behavior.
- Build automation and CI/CD regression suites; automate testbed provisioning, reset, and evidence collection.
- Partner with Engineering, Product Management, and Operations on defect resolution and release gating; guide test reviews and mentor QA engineers.
Required
- 8+ years in software QA, test automation, or security engineering, including ownership of test strategy and release qualification for complex products.
- Hands-on penetration testing experience, with the ability to reproduce vulnerabilities and independently verify findings.
- Experience testing SaaS and on-premises products, including multi-tenancy, deployment, upgrades, and failure recovery.
- Strong Python or equivalent programming skills, with experience building API and system test automation.
- Solid networking, Linux, Windows, authentication, and authorization knowledge; experience troubleshooting distributed services using logs, metrics, and network captures.
- Experience with a major cloud platform, Docker, Kubernetes, and performance or load testing.
- Working knowledge of LLMs and autonomous agents, including tool calling and evaluation of variable outputs.
- Strong technical judgment and communication; able to turn incomplete requirements into test coverage and explain release risks.
- Must be able to work in the US without sponsorship.
Nice to Have
- Experience with autonomous pentesting, vulnerability management, or security validation products; familiarity with the Fortinet ecosystem.
- Knowledge of Active Directory, cloud IAM, MITRE ATT&CK, and OWASP testing methods; practical use of Burp Suite, Nmap, Metasploit, or BloodHound.
- Experience with AI evaluation datasets, adversarial testing, infrastructure as code, or automated security labs.
- OSCP, OSWE, GPEN, or comparable offensive security expertise.
Fortinet offers employees a variety of benefits, including medical, dental, vision, life and disability insurance, 401(k), 11 paid holidays, vacation time, and sick time as well as a comprehensive leave program.
Wage ranges are based on various factors including the labor market, job type, and job level. Earnings for this position are expected to be $200,000 - $310,000 Exact salary offers will be determined by factors such as the candidate's subject knowledge, skill level, qualifications, experience, and geographic location.
All roles are eligible to participate in the Fortinet equity program, Bonus eligibility is reviewed at time of hire and annually at the Company’s discretion