Application Security Engineer – SAST (Checkmarx) – Remote

About the role

We are looking for an Application Security Engineer to own the day‑to‑day operation of SAST tooling in production. You will run, tune, and triage findings from Checkmarx or equivalent tools, ensuring that real vulnerabilities are identified and addressed while minimizing noise.

Key responsibilities

• Run and continuously tune SAST tools (Checkmarx, Fortify, Veracode, Coverity) in production environments.
• Perform source‑to‑sink validation and triage individual security findings.
• Identify, manage, and document false positives versus true vulnerabilities.
• Collaborate with development teams to remediate confirmed issues.
• Improve SAST configurations to reduce noise and increase signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools in production.
• Proven ability to conduct source‑to‑sink validation and triage findings.
• Strong analytical skills to distinguish true from false positives and document decisions.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Source‑to‑sink validation
• Vulnerability triage
• False‑positive management

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible hours and self‑managed schedule.
• Paid parental leave, vacations, and holidays.
• Innovative, multicultural environment with top‑tier talent.
• Mentorship, promotion pathways, and continuous skill development.