Application Security Engineer – Remote (Checkmarx/SAST)

About the role

Join a global team of top‑tier tech talent as an Application Security Engineer focused on static application security testing (SAST). You will operate and fine‑tune SAST tools in production, triage findings, and ensure that real vulnerabilities are addressed while minimizing noise.

Key responsibilities

• Run and continuously tune SAST tooling (e.g., Checkmarx) in production environments.
• Perform source‑to‑sink validation on individual security findings.
• Identify, manage, and document false positives versus true vulnerabilities.
• Collaborate with development teams to remediate confirmed issues.
• Improve SAST configurations to reduce noise and increase signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools such as Checkmarx, Fortify, Veracode, or Coverity in production.
• Proven ability to conduct source‑to‑sink validation and triage security findings.
• Strong analytical skills to distinguish true vulnerabilities from false positives and document decisions clearly.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tools
• Source‑to‑sink validation

What we offer

• 100% remote work from anywhere.
• Competitive compensation paid in USD or local currency.
• Hardware and software setup for home office.
• Flexible hours and self‑managed schedule.
• Paid parental leave, vacations, and holidays.
• Innovative, multicultural environment with mentorship and growth opportunities.