Staff Application Security Engineer

Vestwell is hiring a Staff Application Security Engineer to secure NestJS applications and identity integrations using OAuth 2.0 and OpenID Connect. You will help own security for identity capabilities across both identity-provider (IdP) and relying-party (RP) roles, while strengthening application security across the SDLC.

Location and Work Model

Austin, TX (hybrid)

Salary

USD 190,000 - 200,000 per year

Key Responsibilities

• Analyze NestJS and TypeScript applications for vulnerabilities related to authentication, authorization, input validation, injection, session handling, API security, business logic flaws, and data protection.
• Establish and improve secure development patterns for NestJS, including guards, interceptors, middleware, decorators, validation, error handling, logging, configuration, and dependency management.
• Own and/or contribute to security architecture for OIDC integrations and identity platform capabilities when operating as an IdP, including authorization, token, user-info, discovery, key-set, and logout endpoints.
• Own and/or contribute to security architecture for OIDC integrations and identity platform capabilities when operating as an RP, including client registration, redirect handling, authorization-code flows, token exchange, session establishment, and logout.
• Design, review, and assess OAuth 2.0 and OpenID Connect flows, including authorization code with PKCE, refresh tokens, client authentication, scopes and consent, state and nonce, redirect URI validation, token lifetimes, and key rotation.
• Help define and enforce authorization models using RBAC and, where appropriate, claims-based or policy-based access control.
• Review access-control boundaries across services, APIs, tenants, users, roles, permissions, and administrative functions.
• Lead or participate in threat modeling, security design reviews, architecture reviews, and secure code reviews.
• Build security requirements, reusable libraries, reference implementations, and developer guidance to reduce recurring risk.
• Improve security testing and detection using SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, and targeted security testing.
• Partner with engineering teams to remediate vulnerabilities, prioritize findings by exploitability and business impact, and validate fixes.
• Monitor relevant application and identity security signals, support incident investigations, and contribute to playbooks for account takeover, token compromise, authorization bypass, credential abuse, and related events.
• Maintain security documentation, standards, risk exceptions, and audit evidence for compliance and customer assurance.
• Stay current on application security, identity, OAuth/OIDC, browser security, API security, cloud security, and emerging attack techniques.

Requirements

• Professional experience in application security, product security, software engineering, or a closely related discipline.
• Strong experience securing Node.js and TypeScript applications; hands-on experience with NestJS is required or highly preferred.
• Deep understanding of OAuth 2.0 and OpenID Connect, including common pitfalls and secure deployment patterns.
• Practical experience across both IdP and RP implementations, integrations, or security assessments.
• Strong understanding of authentication and authorization concepts, including RBAC, least privilege, separation of duties, claims, scopes, permissions, sessions, tokens, and service-to-service access.
• Ability to review code and architecture across APIs, web applications, background jobs, and distributed services.
• Experience with web and API security risks, including OWASP Top 10 and OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, insecure deserialization, request forgery, misconfiguration, and supply-chain risk.
• Familiarity with secure token handling, JWT validation, key management, JWKS, signing algorithms, rotation, revocation, and token storage considerations.
• Experience integrating security into CI/CD and developer workflows without unnecessary friction.
• Strong communication skills to explain security risks and tradeoffs to both technical and non-technical audiences.
• Pragmatic and collaborative approach: identify meaningful risk, propose proportional controls, and help implement them.

Technologies

• NestJS, TypeScript, Node.js
• OAuth 2.0, OpenID Connect (OIDC), OIDC authorization code with PKCE
• RBAC, JWT, JWKS
• SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring
• CI/CD
• OWASP Top 10, OWASP API Security Top 10
• OAuth 2.1, FAPI, PAR, JAR, DPoP, sender-constrained tokens
• Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID
• SAML, API gateways, service meshes, microservices, event-driven systems
• Containers, infrastructure as code, secrets management, cloud IAM
• Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP
• OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63

Benefits

• Comprehensive health benefits
• Generous time off
• Dedicated Employee Wellbeing Committee
• Hybrid work model with access to collaborative offices in Midtown Manhattan, Austin, King of Prussia, and Scottsdale
• Competitive 401(k) plan
• Eligible to participate in the Company Bonus Pool
• Eligible to receive new hire equity in the Company

Interview Process

• The interview process begins for every candidate with 1-2 introductory conversations to discuss background, interests, and preferences, while learning more about Vestwell and the team.
• After that, the process varies by role and typically includes a skills or experience-based assessment, such as a coding interview, portfolio review, or a deeper discussion of relevant experience.
• Successful candidates move on to a virtual or in-person interview panel.
• Before extending an offer, Vestwell completes a reference check with a current or former manager and a peer.

Company Priorities During Hiring

Vestwell prioritizes transparency, clear communication, and minimizing surprises throughout the process.

Additional Considerations (THE EXTRAS)

• Experience with OAuth 2.1 guidance, FAPI, PAR, JAR, DPoP, sender-constrained tokens, or other advanced OAuth security patterns.
• Experience with identity platforms or libraries such as Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, or comparable systems.
• Experience with SAML integrations for single sign-on solutions.
• Experience with API gateways, service meshes, microservices, event-driven systems, and cloud-native deployments.
• Familiarity with containers, infrastructure as code, secrets management, and cloud IAM.
• Experience with security tooling such as Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, or equivalent tools.
• Familiarity with security standards and guidance such as OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63, and relevant OAuth/OIDC specifications.
• Experience conducting penetration tests, adversarial reviews, or purple-team exercises.
• Relevant security certifications or equivalent demonstrated experience.