SAST Engineer – Remote

About the role

As a SAST Engineer you will own the static analysis process, tuning tools, creating custom queries and ensuring high‑quality security findings at scale. You will work remotely with a global team of top‑tier engineers.

Key responsibilities

• Operate and fine‑tune SAST tools (e.g., Checkmarx, Fortify, Veracode, Coverity).
• Develop custom rules and queries to improve detection capabilities.
• Perform deep source‑to‑sink validation and triage of static analysis findings.
• Identify and manage false positives, documenting decisions clearly.
• Collaborate with development teams to remediate confirmed vulnerabilities.
• Continuously enhance static analysis configurations and coverage.

Required profile

• 5+ years of dedicated experience in static analysis or application security.
• Hands‑on expertise with at least one major SAST platform (Checkmarx, Fortify, Veracode, or Coverity).
• Proven ability to tune rules, write custom queries, and conduct source‑to‑sink validation.
• Strong analytical skills to distinguish true from false positives.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• Rule tuning
• Custom query development
• Source‑to‑sink validation
• Vulnerability triage

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Provided hardware and software for home office.
• Flexible schedule – create your own hours.
• Paid parental leave, vacation days, and national holidays.
• Multicultural environment with mentorship, promotion pathways, and skill‑development opportunities.