Product Security Engineer – Remote (SAST Triage)

About the role

We are looking for a Product Security Engineer who will focus exclusively on hands‑on static application security testing (SAST) triage. Working remotely, you will analyze real codebases, validate findings and help shape the risk posture of our products.

Key responsibilities

• Perform daily SAST triage, reviewing findings and determining their validity.
• Conduct source‑to‑sink data‑flow analysis and secure code reviews across multiple codebases.
• Document disposition decisions with audit‑traceable evidence in a regulated environment.
• Fine‑tune static analysis tools and manage false‑positive rates across the product portfolio.
• Collaborate with engineering teams to validate and drive remediation of confirmed vulnerabilities.

Required profile

• 5+ years of experience in product security, application security, or software engineering with a hands‑on security focus.
• Proven track record of performing SAST triage rather than just tool integration.
• Strong ability to perform source‑to‑sink analysis and secure code review.
• Experience using SAST tools such as Checkmarx, Fortify, Veracode or Coverity at the findings level.
• Capability to produce audit‑traceable documentation of finding dispositions in compliance‑driven settings.
• Advanced proficiency in English.

Required skills

• SAST triage
• Source‑to‑sink data‑flow analysis
• Secure code review
• Checkmarx
• Fortify
• Veracode
• Coverity

What we offer

• 100 % remote work from anywhere.
• Competitive compensation in USD or local currency.
• Provided hardware and software for home office.
• Flexible schedule – create your own hours.
• Paid parental leave, vacation and holidays.
• Multicultural environment with mentorship, promotion and skill‑development opportunities.