SAST Engineer – Remote

About the role

Join BairesDev as a SAST Engineer and own the static analysis lifecycle for global clients. You will fine‑tune SAST engines, write custom queries, and ensure high‑quality security findings at scale.

Key responsibilities

• Operate and tune SAST tools, including rule customization and custom query development.
• Perform in‑depth triage of static analysis findings through source‑to‑sink validation.
• Manage false positives, documenting true versus false positive determinations.
• Collaborate with development teams to remediate confirmed vulnerabilities.
• Continuously improve static analysis configurations and coverage.

Required profile

• 5+ years of dedicated experience in static analysis or application security.
• Hands‑on expertise with SAST tools such as Checkmarx, Fortify, Veracode, or Coverity.
• Strong source‑to‑sink validation and security finding triage skills.
• Ability to clearly distinguish true from false positives.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• Static analysis rule tuning
• Custom query development
• Source‑to‑sink validation
• Security finding triage

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible schedule and paid parental leave, vacations, holidays.
• Multicultural environment with mentorship, promotions, and skill development opportunities.