Application Security Engineer – SAST (Checkmarx) – Remote

About the role

Join a global team of top‑tier tech talent as an Application Security Engineer focused on static application security testing (SAST). You will operate and fine‑tune Checkmarx or equivalent tools in production, ensuring real vulnerabilities are identified and addressed.

Key responsibilities

• Run and continuously tune SAST tooling in production environments.
• Perform source‑to‑sink validation to triage individual security findings.
• Manage false positives and document decisions on true versus false findings.
• Collaborate with development teams to remediate confirmed vulnerabilities.
• Improve SAST configurations to reduce noise and increase signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools such as Checkmarx, Fortify, Veracode, or Coverity in production.
• Proven ability to conduct source‑to‑sink validation and triage security findings.
• Strong analytical skills to distinguish true vulnerabilities from false positives and document reasoning.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Source‑to‑sink validation
• Vulnerability triage
• False‑positive management

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Provided hardware and software for home office.
• Flexible schedule – create your own hours.
• Paid parental leave, vacations, and holidays.
• Multicultural environment with mentorship, promotion pathways, and skill‑development opportunities.