Application Security Engineer – Checkmarx SAST (Remote)

About the role

As an Application Security Engineer you will own the day‑to‑day operation of SAST tooling in production environments. You will work closely with development teams to validate findings, eliminate false positives, and continuously improve the security posture of the applications.

Key responsibilities

• Run and tune SAST tools (Checkmarx or equivalent) in production.
• Perform source‑to‑sink validation and triage individual security findings.
• Identify, manage, and document false‑positive versus true‑positive determinations.
• Collaborate with developers to remediate confirmed vulnerabilities.
• Continuously refine SAST configurations to reduce noise and improve signal quality.

Required profile

• 5+ years of experience in application security or software engineering.
• Hands‑on experience operating SAST tools such as Checkmarx, Fortify, Veracode, or Coverity in production.
• Proven experience with source‑to‑sink validation and security finding triage.
• Ability to clearly distinguish true vulnerabilities from false positives and document decisions.
• Advanced proficiency in English.

Required skills

• Checkmarx
• Fortify
• Veracode
• Coverity
• SAST tooling
• Source‑to‑sink validation
• Application security analysis

What we offer

• 100% remote work from anywhere.
• Competitive compensation in USD or local currency.
• Hardware and software setup for home office.
• Flexible hours – create your own schedule.
• Paid parental leave, vacations, and holidays.
• Innovative, multicultural environment with top‑tier talent.
• Mentorship, promotion pathways, skill development, and diverse growth opportunities.