Application Security Engineer – Checkmarx SAST (Remote)

About the role

We are looking for an Application Security Engineer to operate and fine‑tune SAST tooling in production environments. You will work hands‑on, triaging findings, managing false positives and ensuring that real vulnerabilities are addressed.

Key responsibilities

• Run and tune SAST tools (Checkmarx or equivalents) in production.
• Perform source‑to‑sink validation on individual security findings.
• Identify and document true versus false positive determinations.
• Collaborate with development teams to remediate confirmed vulnerabilities.
• Continuously improve SAST configurations to reduce noise and increase signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools such as Checkmarx, Fortify, Veracode, or Coverity in production.
• Experience with source‑to‑sink validation and triage of security findings.
• Ability to clearly distinguish true vulnerabilities from false positives and document decisions.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Source‑to‑sink validation

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible hours – create your own schedule.
• Paid parental leave, vacations and holidays.
• Multicultural environment with global top‑1% talent.
• Mentorship, promotion pathways and skill‑development opportunities.