Staff Application Security Engineer

Secure NestJS applications and identity integrations that power Vestwell’s products.

• Application security analysis across authentication, authorization, input validation, injection, session handling, API security, business-logic flaws, and data-protection risks in NestJS and TypeScript
• Establish and evolve secure NestJS development patterns including guards, interceptors, middleware, decorators, validation, error handling, logging, configuration, and dependency management
• Own and shape OIDC security architecture when acting as an Identity Provider (IdP), covering authorization, token, user-info, discovery, key-set, and logout endpoints
• Own and shape OIDC security architecture when acting as a Relying Party (RP), covering client registration, redirect handling, authorization-code flows, token exchange, session establishment, and logout
• Design, review, and assess OAuth 2.0 and OIDC flows including authorization code with PKCE, refresh tokens, client authentication, scopes, consent, state, nonce, redirect URI validation, token lifetimes, and key rotation
• Define and enforce authorization models using RBAC and, where appropriate, claims-based or policy-based access control
• Review access-control boundaries across services, APIs, tenants, users, roles, permissions, and administrative functions
• Threat modeling and security reviews through threat modeling, security design reviews, architecture reviews, and secure code reviews (lead or participate)
• Build security enablement such as security requirements, reusable libraries, reference implementations, and developer guidance to reduce recurring risk
• Improve security testing and detection using SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, and targeted security testing
• Partner with engineering teams to remediate vulnerabilities, prioritize findings by exploitability and business impact, and verify fixes
• Monitor security signals for application and identity threats, support incident investigations, and contribute to playbooks for account takeover, token compromise, authorization bypass, credential abuse, and related events
• Maintain security documentation including standards, risk exceptions, and audit/customer assurance evidence
• Stay current on application security, identity, OAuth/OIDC, browser security, API security, cloud security, and emerging attack techniques

Requirements

• Professional experience in application security, product security, software engineering, or a closely related discipline
• Strong experience securing Node.js and TypeScript applications; hands-on experience with NestJS is required or highly preferred
• Deep understanding of OAuth 2.0 and OpenID Connect, including common implementation pitfalls and secure deployment patterns
• Practical experience with both IdP and RP implementations, integrations, or security assessments
• Strong understanding of authentication and authorization concepts, including RBAC, least privilege, separation of duties, claims, scopes, permissions, sessions, tokens, and service-to-service access
• Ability to review code and architecture across APIs, web applications, background jobs, and distributed services
• Experience with web and API security risks, including OWASP Top 10, OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, insecure deserialization, request forgery, misconfiguration, and supply-chain risk
• Familiarity with secure token handling, JWT validation, key management, JWKS, signing algorithms, rotation, revocation, and token storage considerations
• Experience integrating security into CI/CD and developer workflows without unnecessary friction
• Strong communication skills for explaining security risks and tradeoffs to technical and non-technical audiences
• Pragmatic, collaborative approach to identify meaningful risk, propose proportional controls, and help teams implement them

Technologies

• NestJS, TypeScript, Node.js
• OAuth 2.0, OpenID Connect, OIDC, OAuth 2.1, PKCE
• JWT, JWKS
• RBAC
• SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring
• Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP
• OWASP ASVS, OWASP SAMM
• NIST SSDF, NIST 800-63

Benefits

• Comprehensive health benefits
• Generous time off
• Employee Wellbeing Committee
• Hybrid work model with access to offices in Midtown Manhattan, Austin, King of Prussia, and Scottsdale
• Competitive 401(k) plan

The Extras

• Experience with OAuth 2.1 guidance, FAPI, PAR, JAR, DPoP, sender-constrained tokens, or other advanced OAuth security patterns
• Experience with identity platforms or libraries such as Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, or comparable systems
• Experience with SAML integrations for single sign-on solutions
• Experience with API gateways, service meshes, microservices, event-driven systems, and cloud-native deployments
• Familiarity with containers, infrastructure as code, secrets management, and cloud IAM
• Experience with security tooling such as Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, or equivalent tools
• Familiarity with security standards and guidance such as OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63, and relevant OAuth/OIDC specifications
• Experience conducting penetration tests, adversarial reviews, or purple-team exercises
• Relevant security certifications or equivalent demonstrated experience

Work model: Scottsdale, AZ (hybrid). This role will be based in the New York City, Austin, King of Prussia, or Scottsdale office as part of Vestwell’s hybrid in-office operation.

Compensation

• USD 190,000 - 200,000 per yearly base salary
• Eligible to participate in the Company Bonus Pool and receive new hire equity in the Company
• Salary bands are based on NY and other similar metro areas and may differ based on where the role is ultimately hired

Interview Process

• 1-2 introductory conversations to learn about background and interests, and to share details about Vestwell and the team
• Role-dependent next steps, typically including a skills or experience-based assessment (coding interview, portfolio review, or deeper discussion)
• Virtual or in-person interview panel
• Reference check with a current or former manager and a peer before offer extension
• Emphasis on transparency, clear communication, and minimizing surprises

Privacy Policy / Communications

• Correspondence will be sent only from [email protected]
• Any other domain not ending in vestwell.com is not Vestwell’s recruiting team
• Vestwell Privacy Policy available; California residents may view the CCPA notice at Vestwell’s California Privacy Rights Policy