SAST Engineer – Remote (Full‑time)

About the role

Join BairesDev as a SAST Engineer and own the static analysis lifecycle for global clients. You will fine‑tune SAST engines, develop custom queries, and ensure high‑quality security findings at scale.

Key responsibilities

• Operate and tune SAST tools, including rule customization and custom query development.
• Perform in‑depth triage of static analysis findings through source‑to‑sink validation.
• Manage false positives and document true versus false positive determinations.
• Collaborate with development teams to remediate confirmed vulnerabilities.
• Continuously improve static analysis configurations and coverage.

Required profile

• 5+ years of dedicated experience in static analysis or application security.
• Hands‑on expertise with SAST tools such as Checkmarx, Fortify, Veracode, or Coverity.
• Proven ability to tune rules, develop custom queries, and validate source‑to‑sink flows.
• Strong analytical skills to distinguish true from false positives and document reasoning.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• Rule tuning
• Custom query development
• Source‑to‑sink validation
• Security finding triage

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible hours and self‑managed schedule.
• Paid parental leave, vacations, and holidays.
• Multicultural environment with mentorship, promotions, and skill‑development opportunities.