Fortinet
Principal Software Dev QA Engineer
$200K–$310K
Sunnyvale, CA · On-site · Principal · Full-time · Posted Oct 26, 2026
- Experience
- 8+ years; no alternatives stated.
- Visa sponsorship
- Must be able to work in the US without sponsorship.
About the job
Own end-to-end quality strategy and testing for Fortinet’s AI-powered penetration testing product across SaaS and on-premises deployments.
What you'll do
- Lead product testing across discovery, attack execution, reporting, remediation verification, and deployment environments; establish release criteria.
- Build security test labs and automation to verify findings, AI behavior, assessment safety, tenant isolation, performance, recovery, and result integrity.
- Partner with engineering, product, and operations on defect resolution and release gating; guide test reviews and mentor QA engineers.
What they ask for
- 8+ years in software QA, test automation, or security engineering, including ownership of test strategy and release qualification for complex products.
- Hands-on penetration testing experience and ability to reproduce vulnerabilities and independently verify findings.
- Experience testing SaaS and on-premises products, including multi-tenancy, deployment, upgrades, and failure recovery.
- Strong Python or equivalent programming skills, with API and system test automation experience.
Nice to have
- Experience with autonomous pentesting, vulnerability management, or security validation products; familiarity with the Fortinet ecosystem.
- AI evaluation datasets, adversarial testing, infrastructure as code, automated security labs, or comparable offensive security expertise.
Pay
USD $200,000 - $310,000 (salary; the posting does not specify whether this is base salary or total pay).
Tools
Python, Docker, Kubernetes, Linux, Windows, LLMs, Burp Suite, Nmap
AI focus
Evaluate AI planning, tool use, repeatability, model failures, prompt-injection resistance, variable outputs, and regressions caused by model, prompt, and tool changes.
Model-written summary · the original posting is authoritative