Application Security Engineer – Checkmarx SAST (Remote)

About the role

You will operate SAST tooling in production, running and tuning Checkmarx or equivalent tools, managing false positives, and performing source‑to‑sink validation on individual findings. This hands‑on triage position focuses on distinguishing real vulnerabilities from noise and documenting every decision.

Key responsibilities

• Run and tune SAST tooling in production environments.
• Triage security findings through source‑to‑sink validation.
• Manage false positives and document true versus false positive determinations.
• Collaborate with development teams to remediate confirmed vulnerabilities.
• Continuously improve SAST configurations to reduce noise and improve signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools such as Checkmarx, Fortify, Veracode, or Coverity in production.
• Experience with source‑to‑sink validation and triage of security findings.
• Ability to distinguish true from false positives and document reasoning clearly.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST
• Source‑to‑sink validation

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible hours – create your own schedule.
• Paid parental leave, vacations, and national holidays.
• Innovative, multicultural environment with mentorship and growth opportunities.