Staff Application Security Engineer

Vestwell is hiring a Staff Application Security Engineer to secure NestJS and TypeScript applications and support identity integrations.

Responsibilities

• Analyze NestJS and TypeScript applications for vulnerabilities in authentication, authorization, input validation, injection, session handling, API security, business-logic, and data protection.
• Establish and evolve secure NestJS development patterns, including guards, interceptors, middleware, decorators, validation, error handling, logging, configuration, and dependency management.
• Own and improve security architecture for OIDC/OAuth 2.0 when acting as an Identity Provider (IdP), including authorization, token, user-info, discovery, key-set, and logout endpoints.
• Own and improve security architecture for OIDC/OAuth 2.0 when acting as a Relying Party (RP), including client registration, redirect handling, authorization-code flows, token exchange, session establishment, and logout.
• Design, review, and assess OAuth 2.0 and OIDC flows, including authorization code with PKCE, refresh tokens, client authentication, scopes, consent, state, nonce, redirect URI validation, token lifetimes, and key rotation.
• Define and enforce authorization models using RBAC and, when applicable, claims-based or policy-based access control.
• Review access-control boundaries across services, APIs, tenants, users, roles, permissions, and administrative functions.
• Lead or participate in threat modeling, security design reviews, architecture reviews, and secure code reviews.
• Build security requirements, reusable libraries, reference implementations, and developer guidance to reduce recurring risk.
• Improve security testing and detection using SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring, and targeted security testing.
• Partner with engineering teams to remediate vulnerabilities, prioritize findings by exploitability and business impact, and validate fixes.
• Monitor application and identity security signals, support incident investigations, and contribute to playbooks for account takeover, token compromise, authorization bypass, credential abuse, and related events.
• Maintain security documentation, standards, risk exceptions, and evidence for audits and customer assurance.
• Stay current on application security, identity, OAuth/OIDC, browser security, API security, cloud security, and emerging attack techniques.

Requirements

• Professional experience in application security, product security, software engineering, or a closely related discipline.
• Strong experience securing Node.js and TypeScript applications; hands-on experience with NestJS required or highly preferred.
• Deep understanding of OAuth 2.0 and OpenID Connect, including common implementation pitfalls and secure deployment patterns.
• Practical experience with both IdP and RP implementations, integrations, or security assessments.
• Strong understanding of authentication and authorization concepts, including RBAC, least privilege, separation of duties, claims, scopes, permissions, sessions, tokens, and service-to-service access.
• Ability to review code and architecture across APIs, web applications, background jobs, and distributed services.
• Experience with web and API security risks, including OWASP Top 10 and OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, insecure deserialization, request forgery, misconfiguration, and supply-chain risk.
• Familiarity with secure token handling: JWT validation, key management, JWKS, signing algorithms, rotation, revocation, and token storage considerations.
• Experience integrating security into CI/CD and developer workflows without adding unnecessary friction.
• Strong communication skills to explain security risks and tradeoffs to technical and non-technical audiences.
• Pragmatic, collaborative approach to identify meaningful risk, propose proportional controls, and help teams implement them.

Technologies

• NestJS, TypeScript, Node.js
• OAuth 2.0, OpenID Connect (OIDC), PKCE
• RBAC
• JWT, JWKS
• SAST, DAST
• Software composition analysis, secret scanning
• API testing, dependency monitoring
• CI/CD
• OWASP Top 10, OWASP API Security Top 10

Salary

• USD 190,000 to 200,000 per year

Location

• New York, NY (hybrid)

Benefits

• Comprehensive health benefits
• Generous time off
• Dedicated Employee Wellbeing Committee
• Competitive 401(k) plan

Extras

• Experience with OAuth 2.1 guidance, FAPI, PAR, JAR, DPoP, sender-constrained tokens, or other advanced OAuth security patterns.
• Experience with identity platforms or libraries such as Auth0, Okta, Keycloak, Cognito, Azure AD/Entra ID, or comparable systems.
• Experience with SAML integrations for single sign-on solutions.
• Experience with API gateways, service meshes, microservices, event-driven systems, and cloud-native deployments.
• Familiarity containers, infrastructure as code, secrets management, and cloud IAM.
• Experience with security tooling such as Burp Suite, Semgrep, CodeQL, Snyk, Dependabot, OWASP ZAP, or equivalent tools.
• Familiarity with security standards and guidance such as OWASP ASVS, OWASP SAMM, NIST SSDF, NIST 800-63, and relevant OAuth/OIDC specifications.
• Experience conducting penetration tests, adversarial reviews, or purple-team exercises.
• Relevant security certifications or equivalent demonstrated experience.

Interview Process

• 1-2 introductory conversations for every candidate.
• Role-dependent steps that typically include a skills or experience-based assessment (for example, coding interview, portfolio review, or deeper discussion of relevant experience).
• Virtual or in-person interview panel.
• Reference check with a current or former manager and a peer before an offer.

Full-Time Employee Benefits (Hybrid)

• Hybrid work model with access to offices in Midtown Manhattan, Austin, King of Prussia, and Scottsdale.
• 401(k) plan