Auditor of Fortinet Configurations Deployed in IT and OT

Mission Terms

As part of our activities, we are looking for a Fortinet Auditor.

This is a mission of 5 to 10 working days that will extend from July to August 2026. This audit will take place on-site to conduct an audit of the configurations implemented in Fortinet equipment deployed in its IT and OT environments. The site in Gosselies is not easily accessible by public transport, so possession of a driver's license and a vehicle will be necessary for travel. Travel to other sites is possible.

Mission Context

To perform this audit, the resource will rely on high-level design documents, low-level design documents, as well as configurations from FortiManager and FortiGates. The analysis will be divided into an IT part and an OT part, each presenting its own specificities. It will be required to ensure the level of security and compliance with the manufacturer's best practices. The candidate must prove their skills through Fortinet certifications, security certifications, and by presenting recent references from equivalent missions.

Main Tasks:

The mission will primarily focus on the following elements:

- Control of coherence between:
• target design
• actual configurations

- Verification of equipment hardening:
• administrator access (authentication, restrictions, MFA if applicable)
• securing management plans
• protocols used
- Alignment with:
• Fortinet best practices
• recognized security standards (CIS, ANSSI…)

- Analysis of the structure and organization of rules:
• readability
• overall coherence
• logical structuring (zones, roles, flows)
- Out of scope:
- functional business validation of rules (e.g., authorization of a specific flow)

- Analysis of activated functions:
• IPS / IDS
• antivirus
• web/application filtering
• SSL inspection
• sandboxing/advanced security

- Verification:
• activation consistent with Fortinet best practices
• correct configuration of profiles

- Identification:
• unused available features
• sub-optimal configurations

- Identification:
• obsolete or end-of-support versions
• patching gaps

- Analysis of exposure to known vulnerabilities

Improvement Recommendations

• quick wins
• security enhancements
• maturity increase

• technical risk level
• implementation effort

Expected Approach:

Expected Deliverables

• technical findings
• gaps compared to Fortinet best practices
• associated risks
• recommendations

Expected Approach

• IT vs OT
• OT availability constraints

Key Success Factors

This function potentially requires access to confidential data and is classified as high risk for information systems. Therefore, we are required to verify backgrounds by contacting at least one reference provided for any candidate selected for the mission. If your candidate is selected for an interview, you will be asked to provide the contact details of one or more previous managers for contact. This data will be deleted after 2.5 years following the end of the collaboration or after a maximum of one and a half years if the recruitment process is unsuccessful.