Staff Application Security Engineer

Vestwell is hiring a Staff Application Security Engineer to secure NestJS applications and identity integrations (OIDC), covering identity capabilities as both an IdP and RP.

Responsibilities

• Analyze NestJS and TypeScript applications for security weaknesses across authentication, authorization, input validation, injection, sessions, APIs, business logic, and data protection
• Establish and evolve secure development patterns for NestJS, including guards, interceptors, middleware, decorators, validation, error handling, logging, configuration, and dependency management
• Own or contribute to security architecture for OIDC integrations when operating as an identity provider (IdP), including authorization, token, user-info, discovery, key-set, and logout endpoints
• Own or contribute to security architecture for OIDC integrations when operating as a relying party (RP), including client registration, redirect handling, authorization-code flows, token exchange, session establishment, and logout
• Design, review, and assess OAuth 2.0 and OpenID Connect flows such as authorization code with PKCE, refresh tokens, client authentication, scopes, consent, state, nonce, redirect URI validation, token lifetimes, and key rotation
• Help define and enforce authorization models using RBAC and, when appropriate, claims-based or policy-based access control
• Review access-control boundaries across services, APIs, tenants, users, roles, permissions, and administrative functions
• Lead or participate in threat modeling, security design reviews, architecture reviews, and secure code reviews
• Build security requirements, reusable libraries, reference implementations, and developer guidance to reduce recurring risk
• Improve security testing and detection using SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, and targeted security testing
• Partner with engineering teams to remediate vulnerabilities, prioritize findings by exploitability and business impact, and verify fixes
• Monitor application and identity security signals, support incident investigations, and contribute to playbooks for account takeover, token compromise, authorization bypass, credential abuse, and related events
• Help maintain security documentation, standards, risk exceptions, and evidence needed for audits and customer assurance
• Stay current on application security, identity, OAuth/OIDC, browser security, API security, cloud security, and emerging attack techniques

Requirements

• Professional experience in application security, product security, software engineering, or a closely related discipline
• Strong experience securing Node.js and TypeScript applications; hands-on experience with NestJS is required or highly preferred
• Deep understanding of OAuth 2.0 and OpenID Connect, including common implementation pitfalls and secure deployment patterns
• Practical experience with both IdP and RP implementations, integrations, or security assessments
• Strong understanding of authentication and authorization concepts, including RBAC, least privilege, separation of duties, claims, scopes, permissions, sessions, tokens, and service-to-service access
• Ability to review code and architecture across APIs, web applications, background jobs, and distributed services
• Experience with web and API security risks, including OWASP Top 10, OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, insecure deserialization, request forgery, misconfiguration, and supply-chain risk
• Familiarity with secure token handling, including JWT validation, key management, JWKS, signing algorithms, rotation, revocation, and token storage considerations
• Experience integrating security into CI/CD and developer workflows without unnecessary friction
• Strong communication skills for explaining security risks and tradeoffs to technical and non-technical audiences
• Pragmatic, collaborative approach to identify meaningful risk, propose proportional controls, and help teams implement them

Technologies

• NestJS, TypeScript, Node.js
• OAuth 2.0, OpenID Connect, OIDC, OAuth 2.1
• OIDC (authorization code with PKCE), RBAC, JWT, JWKS
• SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, CI/CD
• OWASP Top 10, OWASP API Security Top 10
• OAuth security patterns and related standards: FAPI, PAR, JAR, DPoP, sender-constrained tokens
• Identity platforms and ecosystems: Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, SAML
• Security tooling and platforms: API gateways, service meshes, microservices, event-driven systems, containers, infrastructure as code, secrets management, cloud IAM
• Tooling and standards examples: Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63

Benefits

• Comprehensive health benefits
• Generous time off
• Dedicated Employee Wellbeing Committee
• Hybrid work model with access to collaborative offices in Midtown Manhattan, Austin, King of Prussia, and Scottsdale
• Competitive 401(k) plan
• Eligible to participate in the Company Bonus Pool
• Eligible to receive new hire equity in the Company

The Extras

• Experience with OAuth 2.1 guidance, FAPI, PAR, JAR, DPoP, sender-constrained tokens, or other advanced OAuth security patterns
• Experience with identity platforms or libraries such as Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, or comparable systems
• Experience with SAML integrations for single sign-on solutions
• Experience with API gateways, service meshes, microservices, event-driven systems, and cloud-native deployments
• Familiarity with containers, infrastructure as code, secrets management, and cloud IAM
• Experience with security tooling such as Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, or equivalent tools
• Familiarity with security standards and guidance such as OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63, and relevant OAuth/OIDC specifications
• Experience conducting penetration tests, adversarial reviews, or purple-team exercises
• Relevant security certifications or equivalent demonstrated experience

Interview Process

• Starts with 1-2 introductory conversations to learn about your background and interests, and to share more about Vestwell and the team
• Role-dependent next steps, typically including a skills or experience-based assessment (for example, coding interview, portfolio review, or deeper discussion)
• Virtual or in-person interview panel for successful candidates
• Reference check with a current or former manager and a peer before an offer
• Emphasis on transparency, clear communication, and minimizing surprises

Location: Austin, TX (hybrid)

Salary: USD 190,000 - 200,000 per year