Application Security Engineer – SAST (Checkmarx) – Remote

About the role

We are looking for an Application Security Engineer to own the day‑to‑day operation of SAST tooling in production. You will work remotely, collaborating with development teams to triage findings, eliminate false positives, and continuously improve the security posture of our applications.

Key responsibilities

• Run and tune SAST tools (Checkmarx or equivalents) in production environments.
• Perform source‑to‑sink validation and triage individual security findings.
• Identify, manage, and document false‑positive versus true‑positive determinations.
• Work closely with developers to remediate confirmed vulnerabilities.
• Continuously refine SAST configurations to reduce noise and improve signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools such as Checkmarx, Fortify, Veracode, or Coverity in production.
• Proven ability to conduct source‑to‑sink validation and triage security findings.
• Strong analytical skills to distinguish true vulnerabilities from false positives and document decisions clearly.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Source‑to‑sink validation

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible hours – create your own schedule.
• Paid parental leave, vacations, and holidays.
• Multicultural environment with mentorship, promotions, and skill‑development opportunities.