Staff Application Security Engineer

Vestwell is seeking a Staff Application Security Engineer to strengthen the security of NestJS applications and identity integrations that support OAuth 2.0 and OpenID Connect. This role spans application security across the SDLC and ownership of security architecture for identity platform capabilities, working closely with engineering and platform teams.

Location and Work Model

King of Prussia, PA (hybrid)

This role is part of a hybrid in-office operation and will be based in the New York City, Austin, King of Prussia, or Scottsdale office.

Salary

The expected base salary range for this position is USD 190,000 to 200,000 per year. The role is eligible to participate in the Company Bonus Pool and may be eligible to receive new hire equity.

Responsibilities

• Analyze NestJS and TypeScript applications for vulnerabilities related to authentication, authorization, input validation, injection, session handling, API and business-logic weaknesses, and data protection.
• Develop and evolve secure NestJS patterns, including guards, interceptors, middleware, decorators, validation, error handling, logging, configuration, and dependency management.
• Own or contribute to security architecture for OIDC integrations when operating as an identity provider, including authorization, token, user-info, discovery, key-set, and logout endpoints.
• Own or contribute to security architecture for OIDC integrations when operating as a relying party, including client registration, redirect handling, authorization-code flows, token exchange, session establishment, and logout.
• Design, review, and assess OAuth 2.0 and OpenID Connect flows, including authorization code with PKCE, refresh tokens, client authentication, scopes, consent, state, nonce, redirect URI validation, token lifetimes, and key rotation.
• Help define and enforce authorization models using RBAC and, where appropriate, claims-based or policy-based access control.
• Review access-control boundaries across services, APIs, tenants, users, roles, permissions, and administrative functions.
• Lead or participate in threat modeling, security design reviews, architecture reviews, and secure code reviews.
• Build security requirements, reusable libraries, reference implementations, and developer guidance to reduce recurring risk.
• Improve security testing and detection through SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, and targeted security testing.
• Partner with engineering teams to remediate vulnerabilities, prioritize findings by exploitability and business impact, and verify fixes.
• Monitor application and identity security signals, support incident investigations, and contribute to playbooks for account takeover, token compromise, authorization bypass, credential abuse, and related events.
• Maintain security documentation, standards, risk exceptions, and audit/customer-assurance evidence.
• Stay current on application security, identity, OAuth/OIDC, browser and API security, cloud security, and emerging attack techniques.

Requirements

• Professional experience in application security, product security, software engineering, or a closely related discipline.
• Strong experience securing Node.js and TypeScript applications; hands-on experience with NestJS is required or highly preferred.
• Deep understanding of OAuth 2.0 and OpenID Connect, including common implementation pitfalls and secure deployment patterns.
• Practical experience with IdP and RP implementations, integrations, or security assessments.
• Strong understanding of authentication and authorization, including RBAC, least privilege, separation of duties, claims, scopes, permissions, sessions, tokens, and service-to-service access.
• Ability to review code and architecture across APIs, web applications, background jobs, and distributed services.
• Experience with web and API security risks, including OWASP Top 10 and OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, insecure deserialization, request forgery, misconfiguration, and supply-chain risk.
• Familiarity with secure token handling, JWT validation, key management, JWKS, signing algorithms, rotation, revocation, and token storage considerations.
• Experience integrating security into CI/CD and developer workflows without unnecessary friction.
• Strong communication skills to explain risks and tradeoffs to both technical and non-technical audiences.
• A pragmatic, collaborative approach to identify meaningful risk and propose proportional controls that teams can implement.

Technologies

NestJS, TypeScript, Node.js, OAuth 2.0, OpenID Connect, OIDC, OAuth 2.1, PKCE, JWT, JWKS, RBAC, SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63

Additional Experience (Extras)

• Experience with OAuth 2.1 guidance and advanced OAuth security patterns such as FAPI, PAR, JAR, DPoP, sender-constrained tokens.
• Experience with identity platforms or libraries including Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, or comparable systems.
• Experience with SAML integrations for single sign-on.
• Experience with API gateways, service meshes, microservices, event-driven systems, and cloud-native deployments.
• Familiarity with containers, infrastructure as code, secrets management, and cloud IAM.
• Familiarity with security tooling such as Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, or equivalents.
• Familiarity with security standards and guidance such as OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63, and relevant OAuth/OIDC specifications.
• Experience conducting penetration tests, adversarial reviews, or purple-team exercises.
• Relevant security certifications or equivalent demonstrated experience.

Benefits

• Comprehensive health benefits
• Generous time off
• Employee Wellbeing Committee
• Competitive 401(k) plan

Employee Benefits Related to the Hybrid Model

The hybrid work model offers flexibility while providing access to collaborative offices in Midtown Manhattan, Austin, King of Prussia, and Scottsdale.

Interview Process

• The process begins with 1 to 2 introductory conversations to learn about background and interests, while also learning about Vestwell and the team.
• Next steps vary by role and typically include a skills or experience-based assessment such as a coding interview, portfolio review, or a deeper discussion of relevant experience.
• Finalists complete a virtual or in-person interview panel.
• Before an offer, Vestwell completes a reference check with a current or former manager and a peer.