Application Security Engineer – SAST (Checkmarx) – Remote

About the role

We are looking for an Application Security Engineer who will own the day‑to‑day operation of SAST tooling in production. You will run and tune Checkmarx (or equivalent) scanners, validate findings from source to sink, and ensure that only genuine vulnerabilities are escalated.

Key responsibilities

• Run, configure and continuously tune SAST tools in production environments.
• Perform source‑to‑sink validation and triage of individual security findings.
• Identify, manage and document false‑positive versus true‑positive determinations.
• Work closely with development teams to remediate confirmed vulnerabilities.
• Improve SAST configurations to reduce noise and increase signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST solutions such as Checkmarx, Fortify, Veracode or Coverity in production.
• Proven ability to conduct source‑to‑sink validation and triage security findings.
• Strong analytical skills to distinguish true vulnerabilities from false positives and document decisions clearly.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• Source‑to‑sink validation

What we offer

• 100 % remote work from anywhere.
• Competitive compensation in USD or local currency.
• Provided hardware and software for a home office.
• Flexible schedule and paid parental leave, vacations and holidays.
• Multicultural environment with mentorship, promotion paths and continuous skill development.