Application Security Engineer

Vestwell is hiring an Application Security Engineer to secure NestJS applications and identity integrations with a focus on application security across the software development lifecycle and OIDC security.

Responsibilities

• Analyze NestJS and TypeScript applications for vulnerabilities across authentication, authorization, input validation, injection, session handling, API security, business-logic flaws, and data protection
• Apply and refine secure development patterns for NestJS, including guards, interceptors, middleware, decorators, validation, error handling, logging, configuration, and dependency management
• Strengthen OIDC integrations and identity platform capabilities when operating as an identity provider (IdP), covering authorization, token, user-info, discovery, key-set, and logout endpoints
• Strengthen OIDC integrations and identity platform capabilities when operating as a relying party (RP), covering client registration, redirect handling, authorization-code flows, token exchange, session establishment, and logout
• Review OAuth 2.0 and OpenID Connect flows, including authorization code with PKCE, refresh tokens, client authentication, scopes, consent, state, nonce, redirect URI validation, and token lifetimes (with guidance from senior team members for more complex cases)
• Apply and maintain authorization models using RBAC and, where appropriate, claims-based or policy-based access control
• Review access-control boundaries across services, APIs, tenants, users, roles, permissions, and administrative functions
• Participate in threat modeling, security design reviews, architecture reviews, and secure code reviews
• Contribute to security requirements, reusable libraries, reference implementations, and developer guidance to reduce recurring risk
• Support security testing and detection efforts, including SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, and targeted security testing
• Partner with engineering teams to remediate vulnerabilities, prioritize findings by exploitability and business impact, and verify fixes
• Monitor application and identity security signals, support incident investigations, and help maintain playbooks for account takeover, token compromise, authorization bypass, credential abuse, and related events
• Help maintain security documentation, standards, risk exceptions, and evidence needed for audits and customer assurance
• Stay current on application security, identity security, OAuth/OIDC, browser security, API security, cloud security, and emerging attack techniques

Requirements

• 2-4 years of professional experience in application security, product security, software engineering, or a closely related discipline
• Experience securing Node.js and TypeScript applications; NestJS familiarity is a strong plus
• Working knowledge of OAuth 2.0 and OpenID Connect concepts and common implementation pitfalls
• Exposure to IdP and/or RP implementations, integrations, or security assessments
• Solid understanding of authentication and authorization concepts, including RBAC, least privilege, claims, scopes, permissions, sessions, and tokens
• Ability to review code across APIs, web applications, and background jobs, with support from senior engineers for complex architectural or distributed-systems questions
• Familiarity with web and API security risks, including OWASP Top 10, OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, insecure deserialization, and misconfiguration
• Basic understanding of secure token handling, JWT validation, JWKS, signing algorithms, and token storage considerations
• Some experience working with CI/CD and developer workflows, or willingness to learn integrating security with minimal friction
• Good communication skills to explain security findings and risk to technical teammates
• Pragmatic, collaborative approach: eager to learn, ask questions, and work with senior engineers to propose and implement proportional controls

Technologies

• NestJS, TypeScript, Node.js
• OAuth 2.0, OpenID Connect, OIDC, OIDC integrations
• PKCE, RBAC, JWT, JWKS
• CI/CD
• SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring
• Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, SAML
• Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP
• OWASP ASVS, NIST SSDF

Benefits

• Comprehensive health benefits
• Generous time off
• Dedicated Employee Wellbeing Committee
• 401(k) plan

The Extras

• Exposure to identity platforms or libraries such as Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, or comparable systems
• Familiarity with SAML integrations for single sign-on solutions
• Exposure to API gateways, microservices, event-driven systems, and cloud-native deployments
• Familiarity with containers, infrastructure as code, secrets management, and cloud IAM basics
• Experience with security tooling such as Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, or equivalent tools
• Familiarity with security standards such as OWASP ASVS or NIST SSDF
• Interest in pursuing relevant security certifications

Interview Process

• 1-2 introductory conversations for background, interests, and what you’re looking for, plus learning about Vestwell and the team
• Role-dependent steps typically include a skills or experience-based assessment, such as a coding interview, portfolio review, or deeper discussion of relevant experience
• Virtual or in-person interview panel for successful candidates
• Reference checks with a current or former manager and a peer before an offer
• Emphasis on transparency, clear communication, and minimizing surprises throughout the process

Full-Time Employee Benefits (Work Model)

• Hybrid work model with flexibility and access to collaborative offices in Midtown Manhattan, Austin, King of Prussia, and Scottsdale

Location and Work Model

• Hybrid role based in the New York City, Austin, King of Prussia, or Scottsdale office

Compensation

• Expected base salary range: $140K - $150K
• Eligible to participate in the Company Bonus Pool
• Eligible to receive new hire equity in the Company
• Salary bands are based on NY and other similar metro areas and may differ based on where the role is hired

Recruiting Contact Notice

• Correspondence will come only from [email protected]
• Any other domain not ending in vestwell.com is not Vestwell’s recruiting team