SAST Engineer – Remote (Full‑time)

About the role

As a SAST Engineer you will own the static analysis platform that protects our clients' applications. You will fine‑tune rules, write custom queries and ensure that security findings are accurate and actionable.

Key responsibilities

• Operate and tune SAST tools (Checkmarx, Fortify, Veracode, Coverity) including rule customization and custom query development.
• Perform deep source‑to‑sink validation and triage of static analysis findings.
• Identify and manage false positives, documenting true versus false determinations.
• Collaborate with development teams to remediate confirmed vulnerabilities.
• Continuously improve static analysis configurations, coverage, and overall engine performance.

Required profile

• 5+ years of dedicated experience in static analysis or application security.
• Hands‑on expertise with at least one major SAST tool and experience creating custom rules/queries.
• Strong source‑to‑sink validation and security finding triage skills.
• Ability to clearly distinguish true from false positives and document reasoning.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• Static analysis
• Rule tuning
• Custom query development
• Source‑to‑sink validation
• Vulnerability triage

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible schedule and paid parental leave, vacations, national holidays.
• Multicultural environment with mentorship, promotions, and skill‑development opportunities.