Product Security Engineering Intern

**Description**

Are you a student or a recent graduate looking for an internship within a fast-growing international environment and passionate about developing a strong experience in product security?

Then more reason to join this exciting Product Security Internship opportunity at Fortinet in Sophia-Antipolis

As a Product Security Intern, you will join Fortinet’s highly skilled PSIRT team in Sophia-Antipolis, in charge of handling security incidents and performing vulnerability research on Fortinet products. You will benefit from an extensive training program allowing you to become an expert in your field. You will be able to develop a strong experience in product security, to show your ability to investigate and help remedy vulnerabilities.

**Mission**

You will be able to focus your internship project on one of the following two key areas:

API fuzzing should allow the Product Security team to detect variants of flaws previously discovered through source code analysis, manual testing, or external research reports. The tool might also detect new issues using chosen inputs.

- The goal of the internship would be to

• Understand and give detailed description / presentation on existing tools for API fuzzing.
• Adapt existing tools or develop a tool to detect security issues on Fortinet products. The scope of tests will rely on the API documentation (Swagger/OpenAPI) of the tested Fortinet product.
• The tool should be able to distinguish correct web responses from unintended behaviors leading to security issues.
• The main goal is to reinforce coverage of dynamic testing toolkit (DAST) over Fortinet products.
• **SAST **tool selection for team usage**: Research and security-based project which consist in adding a Static security evaluation tool for our auditing job. A static analyzer tool (SAST) performs the analysis of the code of the product without running it, indicating any possible vulnerability flaws.
• By selecting a set of libraries at their vulnerable versions, a set of SAST tools are run on them to determine the best one that is able to detect most of the already known as well as possible new vulnerabilities present in the code.
• Relying on open-source projects which are included in Fortinet products, the intern’s key responsibilities will be to 1. analyze and 2. select the best SAST tool to add to our tools bank.
• The SAST tools evaluation will require the intern to consider the possibility to add specific company rules to the SAST tool, indications of false positives, and any additional potentially useful features that could help in our auditing job (i.e., the presence of submodule to detect hardcoded credentials).
• The SAST tool selection is more a research-oriented project which will require the intern to have basic analytical knowledge and skills to analyze results (i.e., vulnerability paths analysis, false positive and false negative classification).
• This is expected to take one to two months.
• By the end of the project, the intern would have improved his/her analytical and presentation skills, and ability to do source code analysis and selection criteria.

**Requirements and Profile**

**Background and Experience**

• Good security background with an understanding of vulnerabilities at source-code level.
• In-depth understanding of asymmetric cryptography and web protocols; high proficiency in C language is mandatory.
• Experience in Static and Dynamic Application Security Testing tools, source code auditing, vulnerability research, pentesting methodologies and fuzzing tools a plus.

**Skills**

• Good analytical skills - ability to understand and analyze information strategically.
• Detail oriented - follow processes thoroughly.
• Team player - interact effectively within individual team and other departments alike.
• Understanding of Fortinet product line-up a plus.
• Good knowledge of English (written and spoken).

**Education**

• BS in Computer Science or equivalent required.
• MS in Computer science preferred.