Hybrid Application Security Engineer (Equity Eligible)

Cybersecurity Jobs; King of Prussia (PA); Hybrid; USD 140,000 - 150,000; Full time

Benefits offered by this job

Health benefits

Generous time off

Employee Wellbeing Committee

401(k) plan

Job summary

Vestwell is seeking an Application Security Engineer to secure NestJS applications and identity integrations across the software development lifecycle and OIDC security.

You will analyze and strengthen authentication/authorization, implement secure patterns in NestJS, and work with IdP/RP deployments. Collaboration with engineering teams and ongoing security testing are core parts of the role.

Qualifications

• 2-4 years of professional experience in application security, product security, software engineering, or related discipline.
• Experience securing Node.js and TypeScript applications; NestJS familiarity is a strong plus.
• Working knowledge of OAuth 2.0 and OpenID Connect concepts and common pitfalls.
• Exposure to IdP and/or RP implementations, integrations, or security assessments.
• Solid understanding of authentication and authorization concepts (RBAC, least privilege, claims, tokens).
• Ability to review code across APIs, web apps, and background jobs with senior support.
• Familiarity with web and API security risks (OWASP Top 10, API Security Top 10, XSS, CSRF, SSRF).
• Basic understanding of JWT validation, JWKS, signing algorithms, and token storage.

Responsibilities

• Analyze NestJS and TypeScript apps for vulnerabilities across authentication, authorization, input validation, injection, session handling, API security, and data protection.
• Apply secure development patterns for NestJS including guards, interceptors, middleware, decorators, validation, error handling, logging, and config management.
• Strengthen OIDC integrations and identity platform capabilities as IdP (authorization, token, user-info, discovery).
• Strengthen OIDC integrations as RP (client registration, redirect handling, authorization-code flows, token exchange, session, logout).
• Review OAuth 2.0 and OpenID Connect flows including PKCE, refresh tokens, scopes, consent, state, nonce, and token lifetimes.
• Apply and maintain authorization models using RBAC and claims-based or policy-based access control.
• Review access-control boundaries across services, APIs, tenants, users, roles, permissions, and admin functions.
• Participate in threat modeling, security design reviews, architecture reviews, and secure code reviews.
• Contribute to security requirements, reusable libraries, reference implementations, and developer guidance.
• Support security testing and detection efforts (SAST, DAST, software composition analysis, secret scanning, API testing, dependency monitoring).
• Partner with engineering teams to remediate vulnerabilities and verify fixes.
• Monitor security signals, assist incident investigations, and help maintain playbooks for account takeover and token compromise.
• Help maintain security documentation, standards, risk exceptions, and evidence for audits and customer assurance.
• Stay current on application security, identity security, OAuth/OIDC, browser security, API security, cloud security.

Skills

Node.js

TypeScript

OAuth 2.0

OpenID Connect

RBAC

CI/CD

Security reviews

Communication

Tools

NestJS

JWT

JWKS

Burp Suite

Semgrep

CodeQL

Snyk

OWASP ZAP

Auth0

Okta

Keycloak

Cognito

Azure AD/Entra ID

Job description

Vestwell is seeking an Application Security Engineer to secure NestJS applications and identity integrations across the software development lifecycle and OIDC security.

You will analyze and strengthen authentication/authorization, implement secure patterns in NestJS, and work with IdP/RP deployments. Collaboration with engineering teams and ongoing security testing are core parts of the role.