Application Security Engineer (Remote)

About the role

As an Application Security Engineer you will focus on hands‑on SAST triage, secure code review, and source‑to‑sink validation. You will operate SAST tooling in production, evaluate each finding, and decide what truly needs remediation, directly protecting our customers' production systems.

Key responsibilities

• Perform dedicated SAST triage, validating findings from source to sink.
• Operate, tune, and maintain SAST tools in production environments.
• Conduct secure code reviews and document true versus false positive determinations.
• Collaborate with development teams to remediate confirmed vulnerabilities.
• Improve analysis signal quality by reducing noise and refining rule configurations.

Required profile

• 5+ years of experience in application security with a strong focus on hands‑on SAST triage.
• Deep experience operating SAST tools such as Checkmarx, Fortify, Veracode, or Coverity in production.
• Proven ability to perform source‑to‑sink validation and secure code review.
• Experience managing false positives and documenting security finding decisions with precision.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Secure code review
• Source‑to‑sink validation

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible hours – create your own schedule.
• Paid parental leave, vacations, and holidays.
• Innovative, multicultural environment with the world’s top 1% tech talent.
• Mentorship, promotion pathways, skill development, and diverse growth opportunities.