Application Security Engineer (SAST) – Remote

About the role

We are looking for an Application Security Engineer to operate and fine‑tune SAST tools in production. You will be hands‑on in triaging findings, managing false positives and collaborating with development teams to remediate real vulnerabilities.

Key responsibilities

• Run and tune SAST tooling (Checkmarx or equivalent) in production environments.
• Perform source‑to‑sink validation and triage individual security findings.
• Identify and document true versus false positive determinations.
• Work with developers to remediate confirmed vulnerabilities.
• Continuously improve SAST configurations to reduce noise and enhance signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools such as Checkmarx, Fortify, Veracode, or Coverity in production.
• Proven ability to perform source‑to‑sink validation and triage security findings.
• Strong analytical skills to distinguish true from false positives and document decisions clearly.
• Advanced proficiency in English.

Required skills

• Checkmarx (or similar SAST tools)
• Fortify
• Veracode
• Coverity

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Provided hardware and software for home office.
• Flexible schedule.
• Paid parental leave, vacations and holidays.
• Mentorship, promotions and skill‑development opportunities.