Application Security Engineer – SAST (Checkmarx) – Remote

About the role

BairesDev is seeking an experienced Application Security Engineer to own the day‑to‑day operation of SAST tooling in production. You will run, tune, and triage findings from Checkmarx or equivalent solutions, ensuring that real vulnerabilities are identified and addressed while minimizing noise.

Key responsibilities

• Operate and continuously fine‑tune SAST tools (e.g., Checkmarx, Fortify, Veracode, Coverity) in production environments.
• Perform source‑to‑sink validation on each security finding to confirm true vulnerabilities.
• Manage false positives, documenting the rationale for each decision.
• Collaborate with development teams to remediate confirmed issues.
• Improve SAST configurations to reduce false positives and increase signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools in production.
• Proven ability to conduct source‑to‑sink validation and triage findings.
• Strong analytical skills to differentiate true from false positives.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Source‑to‑sink validation

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Provided hardware and software for home office.
• Flexible schedule and paid parental leave, vacations, holidays.
• Mentorship, promotion pathways, and skill‑development opportunities within a multicultural, top‑talent environment.