Staff Application Security Engineer

Vestwell is hiring a Staff Application Security Engineer to secure NestJS applications and identity integrations that support OIDC, spanning the SDLC and OIDC security architecture.

Responsibilities

• Analyze NestJS and TypeScript applications for vulnerabilities in authentication, authorization, input validation, injection, session handling, API security, business-logic flaws, and data protection.
• Create and evolve secure NestJS development patterns, including guards, interceptors, middleware, decorators, validation, error handling, logging, configuration, and dependency management.
• Own and/or contribute to security architecture for OIDC when acting as an identity provider (IdP), covering authorization, token, user-info, discovery, key-set, and logout endpoints.
• Own and/or contribute to security architecture for OIDC when acting as a relying party (RP), covering client registration, redirect handling, authorization-code flows, token exchange, session establishment, and logout.
• Design, review, and assess OAuth 2.0 and OpenID Connect flows, including authorization code with PKCE, refresh tokens, client authentication, scopes, consent, state and nonce, redirect URI validation, token lifetimes, and key rotation.
• Define and help enforce authorization models using RBAC and, where appropriate, claims-based or policy-based access control.
• Review access-control boundaries across services, APIs, tenants, users, roles, permissions, and administrative functions.
• Lead or participate in threat modeling, security design reviews, architecture reviews, and secure code reviews.
• Build reusable security requirements, libraries, reference implementations, and developer guidance to reduce recurring risk.
• Improve security testing and detection using SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, and targeted security testing.
• Partner with engineering teams to remediate vulnerabilities, prioritize by exploitability and business impact, and verify fixes.
• Monitor application and identity security signals, support incident investigations, and contribute to playbooks for account takeover, token compromise, authorization bypass, credential abuse, and related events.
• Maintain security documentation, standards, risk exceptions, and audit/customer-assurance evidence.
• Stay current on application security, identity security, OAuth/OIDC, browser security, API security, cloud security, and emerging attack techniques.

Requirements

• Professional experience in application security, product security, software engineering, or a closely related discipline.
• Strong experience securing Node.js and TypeScript applications; hands-on experience with NestJS required or highly preferred.
• Deep understanding of OAuth 2.0 and OpenID Connect, including common implementation pitfalls and secure deployment patterns.
• Practical experience with both IdP and RP implementations, integrations, or security assessments.
• Strong understanding of authentication and authorization concepts, including RBAC, least privilege, separation of duties, claims, scopes, permissions, sessions, tokens, and service-to-service access.
• Ability to review code and architecture across APIs, web applications, background jobs, and distributed services.
• Experience with web and API security risks, including OWASP Top 10, OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, insecure deserialization, request forgery, misconfiguration, and supply-chain risk.
• Familiarity with secure token handling: JWT validation, key management, JWKS, signing algorithms, rotation, revocation, and token storage considerations.
• Experience integrating security into CI/CD and developer workflows without unnecessary friction.
• Strong communication skills to explain security risks and tradeoffs to technical and non-technical stakeholders.
• Pragmatic, collaborative approach to identify meaningful risk, propose proportional controls, and help teams implement them.

Required / Preferred Technologies

• NestJS, TypeScript, Node.js
• OAuth 2.0, OpenID Connect, OIDC, OAuth 2.1
• PKCE, JWT, JWKS
• RBAC
• SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring
• Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP
• OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63

Benefits

• Comprehensive health benefits
• Generous time off
• Employee Wellbeing Committee
• Competitive 401(k) plan

The Extras (Preferred)

• Experience with OAuth 2.1 guidance, FAPI, PAR, JAR, DPoP, sender-constrained tokens, or other advanced OAuth security patterns.
• Experience with identity platforms or libraries such as Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, or comparable systems.
• Experience with SAML integrations for single sign-on solutions.
• Experience with API gateways, service meshes, microservices, event-driven systems, and cloud-native deployments.
• Familiarity with containers, infrastructure as code, secrets management, and cloud IAM.
• Experience with security tooling such as Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, or equivalent tools.
• Familiarity with security standards and guidance such as OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63, and relevant OAuth/OIDC specifications.
• Experience conducting penetration tests, adversarial reviews, or purple-team exercises.
• Relevant security certifications or equivalent demonstrated experience.

Hybrid Work / Location

• King of Prussia, PA (hybrid)
• Hybrid in-office operation supports access to offices in Midtown Manhattan, Austin, King of Prussia, and Scottsdale.
• Role location will be based in either the New York City, Austin, King of Prussia, or Scottsdale office.

Salary

• Expected base salary range: $190,000 - $200,000
• Eligible to participate in the Company Bonus Pool
• Eligible to receive new hire equity in the Company

Interview Process

• 1-2 introductory conversations to learn about your background and interests and to share more about Vestwell and the team.
• Role-dependent assessment (skills or experience-based), such as a coding interview, portfolio review, or deeper discussion of relevant experience.
• Virtual or in-person interview panel.
• Reference check with a current or former manager and a peer before offer extension.
• Emphasis on transparency, clear communication, and minimizing surprises throughout the process.