{"id":3494166,"url":"https://alion.io/job/fortinet-software-engineer-fortisiem-threat-detection-integration","title":"Software Engineer – FortiSIEM Threat Detection & Integration","company":{"id":52696,"name":"Fortinet","domain":"fortinet.com","url":"https://alion.io/company/fortinet-blog","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"A","score":86,"open_postings":182,"ghost_share":0,"stale_share":0.769,"repost_share":0,"time_to_fill_p50_days":3,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Backend","role_family":"Backend","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Sunnyvale, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":123000,"max":151000,"currency":"USD","period":"year","gross":null,"usd_annual":151000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Git","optional":false},{"name":"GitLab","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"C++","optional":true},{"name":"CI/CD","optional":true},{"name":"GCP","optional":true},{"name":"Rest API","optional":true}],"status":"live","first_seen_at":"2026-10-29T22:11:26Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-03T01:50:35Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"We are seeking a software engineer to join the FortiSIEM Advanced Threat Integration engineering team. This role combines hands-on software development with security detection engineering. The engineer will work close to the data path: ingesting and normalizing security telemetry, building parsers and integrations, modeling detections, and developing the supporting code and tooling required to deliver reliable FortiSIEM content.\nResponsibilities\nAnalyze raw security and audit logs from Fortinet and third-party products to understand their structure and important fields.\nBuild and maintain FortiSIEM log parsers that extract and normalize data into standard event attributes.\nCreate and update FortiSIEM security rules, reports, dashboards, and related detection content.\nResearch vendor documentation, advisories, and sample logs to support new integrations and detections.\nDevelop and maintain lightweight integrations and supporting tools using Python, regex, APIs, and basic scripting.\nTest and troubleshoot parsers, rules, and integrations using representative log samples and expected results.\nWork in Linux environments and use Git/GitLab for source control, code review, and team development.\nCollaborate with developers, QA, support, and security researchers to review, validate, and release FortiSIEM content.\nRequired Qualifications\nBS in Computer Science, Computer Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.\n3+ years of software engineering experience for candidates with a BS, or 2+ years with an MS.\nStrong Python programming skills, including data structures, file and network I/O, error handling, testing, and debugging.\nStrong regular-expression skills and the ability to reason about correctness and performance when parsing untrusted or irregular log data.\nSolid understanding of core programming concepts including algorithms, data structures, complexity, object-oriented design, and concurrent or asynchronous execution where applicable.\nGood working knowledge of Linux, including processes, files, permissions, networking basics, command-line troubleshooting, and shell scripting.\nWorking knowledge of Git/GitLab and collaborative code-review workflows.\nAbility to read unfamiliar logs, APIs, schemas, and vendor documentation and convert them into deterministic software and detection logic.\nStrong debugging and problem-solving ability, with attention to edge cases and reproducible testing.\nAbility to work effectively in a distributed engineering team and to communicate technical reasoning clearly.\nSecurity / SIEM Knowledge\nExperience with SIEM, security analytics, log management, EDR, firewall, identity, cloud, or other security telemetry is strongly preferred.\nUnderstanding of common security event concepts such as source/destination identity, authentication events, process execution, network activity, vulnerabilities, and security-product actions.\nFamiliarity with detection engineering concepts such as false positives, detection coverage, correlation, baselining, thresholds, and MITRE ATT&CK is a plus.\nPrior experience developing SIEM parsers, correlation rules, Sigma-style detections, or security-content packages is a strong plus.\nPreferred / Nice to Have\nWorking knowledge of C++ for lower-level or performance-sensitive components.\nExperience with REST APIs, JSON, XML, syslog, TLS, sockets, and common authentication mechanisms.\nExperience with distributed or high-throughput event-processing systems.\nExperience with at least one public cloud platform (AWS, Azure, or GCP).\nExperience building developer tooling, automated test harnesses, or CI/CD checks for data/content pipelines.\nWhat This Role Is\nThis is not a pure security-analyst role and not a generic application-development role. The engineer is expected to write production code and tooling while also understanding how security telemetry should be normalized and converted into reliable detections. The role sits at the boundary between software engineering, data parsing/integration, and detection engineering.\nMust be authorized to work in the U.S. without sponsorship.\nThe US base salary range for this full-time position is $123,000-$151,000. Fortinet offers employees a variety of benefits, including medical, dental, vision, life and disability insurance, 401(k), 11 paid holidays, vacation time, and sick time, as well as a comprehensive leave program.\nWage ranges are based on various factors, including the labour market, job type, and job level. Exact salary offers will be determined by factors such as the candidate's subject knowledge, skill level, qualifications, experience, and geographic location.\nAll roles are eligible to participate in the Fortinet equity program. Bonus eligibility is reviewed at the time of hire and annually at the Company’s discretion.\nWhy Join Us:\nWe encourage candidates from all backgrounds and identities to apply. We offer a supportive work environment and a competitive Total Rewards package to support you with your overall health and financial well-being.\nEmbark on a challenging, enjoyable, and rewarding career journey with Fortinet. Join us in bringing solutions that make a meaningful and lasting impact to our 890,000+ customers around the globe.","description_format":"text","description_chars":5267,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Network Security","Endpoint Security","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-30T00:48:30Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 125 · green card filings: 113","filings_12m":125,"filings_prev_12m":189,"green_card_filings_12m":113,"median_offered_wage_usd":157500,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":48}],"liveness":{"score":32,"band":"fade","label":"Fading","p_open":1,"p_active":0.576,"p_room":0.55,"age_days":3,"expected_fill_days":3,"reasons":["conf:1","stale_co","velocity","win:tail","comp:brand"],"computed_at":"2026-11-02T06:13:15Z"},"pay":{"stated_usd_annual":151000,"is_top_pay":false},"html_url":"https://alion.io/job/fortinet-software-engineer-fortisiem-threat-detection-integration","json_url":"https://alion.io/job/fortinet-software-engineer-fortisiem-threat-detection-integration.json","meta":{"generated_at":"2026-11-03T04:40:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6367,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":52696},"rest":"https://alion.io/mcp/rest/get_company?id=52696"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffortinet-software-engineer-fortisiem-threat-detection-integration"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffortinet-software-engineer-fortisiem-threat-detection-integration"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffortinet-software-engineer-fortisiem-threat-detection-integration"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/fortinet-software-engineer-fortisiem-threat-detection-integration\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffortinet-software-engineer-fortisiem-threat-detection-integration"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3494166}},{"tool":"search_jobs","arguments":{"company":"fortinet.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3494166},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}