Application Security Engineer – Checkmarx SAST (Remote)

About the role

We are looking for an Application Security Engineer to own the day‑to‑day operation of our Static Application Security Testing (SAST) platform. You will work remotely, collaborating with development teams to ensure real security findings drive the protection of our production systems.

Key responsibilities

• Run and continuously tune Checkmarx or equivalent SAST tools in production environments.
• Perform source‑to‑sink validation and triage each security finding.
• Identify, manage, and document false positives versus true vulnerabilities.
• Partner with developers to remediate confirmed issues.
• Improve SAST configurations to reduce noise and increase signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools such as Checkmarx, Fortify, Veracode, or Coverity in production.
• Proven ability to conduct source‑to‑sink validation and triage findings.
• Strong analytical skills to distinguish true vulnerabilities from false positives and document decisions clearly.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Source‑to‑sink validation

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible schedule – create your own hours.
• Paid parental leave, vacations and holidays.
• Multicultural environment with mentorship, promotions and skill‑development opportunities.