Application Security Engineer – SAST (Checkmarx) – Remote

About the role

We are looking for an Application Security Engineer to own and operate our Static Application Security Testing (SAST) platform. You will work remotely, collaborating with development teams to ensure real security findings are identified, triaged, and remediated.

Key responsibilities

• Run and continuously tune SAST tools (Checkmarx or equivalents) in production environments.
• Perform source‑to‑sink validation and triage individual security findings.
• Identify, manage, and document false positives versus true vulnerabilities.
• Partner with developers to remediate confirmed issues.
• Improve SAST configurations to reduce noise and increase signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST solutions such as Checkmarx, Fortify, Veracode, or Coverity.
• Proven ability to conduct source‑to‑sink validation and triage findings.
• Strong analytical skills to distinguish true vulnerabilities from false positives.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• Source‑to‑sink validation
• Vulnerability triage

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Provided hardware and software for home office.
• Flexible schedule and paid parental leave, vacations, holidays.
• Access to a multicultural team of top‑tier tech talent.