AppSec Engineer – Remote

About the role

As an Application Security Engineer you will focus on hands‑on SAST triage, secure code review and source‑to‑sink validation, directly protecting production systems.

Key responsibilities

• Perform dedicated SAST triage, evaluating individual findings through source‑to‑sink validation.
• Operate, tune and maintain SAST tools in production environments.
• Conduct secure code reviews and document true versus false positive determinations.
• Collaborate with development teams to remediate confirmed vulnerabilities.
• Improve analysis signal quality by reducing noise and refining rule configurations.

Required profile

• 5+ years of experience in application security with a strong focus on hands‑on SAST triage.
• Deep experience operating SAST tools such as Checkmarx, Fortify, Veracode or Coverity in production.
• Proven ability to perform source‑to‑sink validation and secure code review.
• Experience managing false positives and documenting security finding decisions with precision.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Source‑to‑sink validation
• Secure code review
• False positive management

What we offer

• 100 % remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible hours and self‑managed schedule.
• Paid parental leave, vacation and national holidays.
• Innovative multicultural environment with mentorship, promotions and skill‑development opportunities.