Application Security Engineer

Vestwell is hiring an Application Security Engineer to help secure NestJS applications and the identity integrations that support its products. In this hybrid role based in the Scottsdale, AZ office (with team presence in other nearby office options as part of the hybrid model), you will work across the application security lifecycle and strengthen both OpenID Connect identity provider and relying party capabilities. Salary is USD 140,000 - 150,000, with eligibility for a Company Bonus Pool and new hire equity, plus a competitive 401(k) and comprehensive benefits.

What you’ll focus on

• Review NestJS and TypeScript applications for security issues across authentication, authorization, input validation, injection, session handling, API exposure, business-logic flaws, and data protection.
• Apply and help refine secure development patterns for NestJS, including guards, interceptors, middleware, decorators, validation, error handling, logging, configuration, and dependency management.
• Strengthen the security of OIDC integrations when operating as an identity provider, including authorization, token, user-info, discovery, key-set, and logout endpoints.
• Strengthen the security of OIDC integrations when operating as a relying party, including client registration, redirect handling, authorization-code flows, token exchange, session establishment, and logout.
• Review OAuth 2.0 and OpenID Connect flows, including authorization code with PKCE, refresh tokens, client authentication, scopes and consent, state and nonce, redirect URI validation, and token lifetimes, with guidance from senior team members for complex cases.
• Help maintain authorization models using RBAC, and where appropriate claims-based or policy-based access control.
• Assess access-control boundaries across services, APIs, tenants, users, roles, permissions, and administrative functions.
• Contribute to threat modeling, security design reviews, architecture reviews, and secure code reviews.
• Support security testing and detection efforts, including SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, and targeted security testing.
• Partner with engineering teams to remediate vulnerabilities, help prioritize findings by exploitability and business impact, and verify fixes.
• Monitor application and identity security signals, support incident investigations, and help maintain playbooks for account takeover, token compromise, authorization bypass, credential abuse, and related events.
• Help maintain security documentation, standards, risk exceptions, and evidence needed for audits and customer assurance.
• Stay current on application and identity security topics including OAuth/OIDC, browser security, API security, cloud security, and emerging attack techniques.

What you bring

• 2-4 years of professional experience in application security, product security, software engineering, or a closely related discipline.
• Experience securing Node.js and TypeScript applications; NestJS familiarity is a strong plus.
• Working knowledge of OAuth 2.0 and OpenID Connect concepts and common implementation pitfalls.
• Exposure to IdP and/or RP implementations, integrations, or security assessments.
• Strong understanding of authentication and authorization concepts, including RBAC, least privilege, claims, scopes, permissions, sessions, and tokens.
• Ability to review code across APIs, web applications, and background jobs, with support from senior engineers for more complex questions.
• Familiarity with web and API security risks, including OWASP Top 10, OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, insecure deserialization, and misconfiguration.
• Basic understanding of secure token handling, including JWT validation, JWKS, signing algorithms, and token storage considerations.
• Some experience with CI/CD and developer workflows, or willingness to learn how to integrate security into them with minimal friction.
• Good communication skills to explain security findings and risk to technical teammates.
• A pragmatic, collaborative approach: eager to learn, ask good questions, and work with more senior engineers to propose and implement proportional controls.

Technologies

NestJS, TypeScript, Node.js, OAuth 2.0, OpenID Connect (OIDC)

Benefits and extras

• Comprehensive health benefits
• Generous time off
• Employee Wellbeing Committee
• Competitive 401(k) plan
• Company Bonus Pool eligibility
• New hire equity
• Hybrid access to collaborative offices in Midtown Manhattan, Austin, King of Prussia, and Scottsdale

Additional experience that’s a plus

• Exposure to identity platforms or libraries such as Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, or comparable systems.
• Familiarity with SAML integrations for single sign-on solutions.
• Exposure to API gateways, microservices, event-driven systems, and cloud-native deployments.
• Familiarity with containers, infrastructure as code, secrets management, and cloud IAM basics.
• Experience with security tooling such as Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, or equivalent tools.
• Familiarity with security standards such as OWASP ASVS or NIST SSDF.
• Interest in pursuing relevant security certifications.

Interview process

• 1-2 introductory conversations
• Virtual or in-person interview panel
• Reference check with a current or former manager and a peer before an offer

Candidate correspondence: You will only receive correspondence from [email protected]. Any other domain not ending in vestwell.com is not the Recruitment team.