Application Security Engineer – Checkmarx SAST (Remote)

About the role

We are looking for an Application Security Engineer who will own the day‑to‑day operation of our static application security testing (SAST) platform. The role focuses on running and tuning Checkmarx (or equivalent) in production, validating findings from source to sink, and ensuring that only genuine vulnerabilities are escalated.

Key responsibilities

• Deploy, configure, and continuously tune SAST tools in production environments.
• Perform source‑to‑sink validation and triage of individual security findings.
• Identify, manage, and document false‑positive versus true‑positive determinations.
• Work closely with development teams to remediate confirmed vulnerabilities.
• Improve SAST rule sets and configurations to reduce noise and increase signal quality.

Required profile

• Minimum 5 years of experience in application security or software engineering.
• Hands‑on experience operating SAST solutions such as Checkmarx, Fortify, Veracode or Coverity in a production setting.
• Proven ability to conduct source‑to‑sink validation and triage security findings.
• Strong analytical skills to distinguish true vulnerabilities from false positives and document decisions clearly.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Source‑to‑sink validation
• Vulnerability triage

What we offer

• 100 % remote work from any location.
• Competitive compensation paid in USD or local currency.
• Provided hardware and software for a home office.
• Flexible schedule and paid parental leave, vacation and holidays.
• Multicultural environment with mentorship, career growth and skill‑development opportunities.