Staff AppSec Engineer — NestJS & Identity

Vestwell; New York, Austin, King of Prussia, Scottsdale (NY, TX, PA, AZ); Hybrid; USD 190,000 - 200,000; Full time

Benefits offered by this job

Hybrid in-office operation

New hire equity

401(k) plan

Job summary

Vestwell is seeking a Staff Application Security Engineer to secure NestJS and TypeScript applications, focusing on authentication, authorization, and identity integrations. You will own security across OIDC flows and act as both IdP and RP within the platform.

You will collaborate with software engineering, platform, and product teams to implement secure-by-default practices, review threat models, and improve CI/CD security tooling and processes.

Qualifications

• Strong experience securing Node.js and TypeScript apps, with NestJS preferred.
• Deep understanding of OAuth 2.0 and OpenID Connect, incl. pitfalls and secure deployment.
• Experience with IdP and RP implementations, integrations, or security assessments.
• Knowledge of authentication/authorization concepts: RBAC, least privilege, tokens, scopes, and sessions.
• Ability to review code/architecture across APIs, web apps, and distributed services.
• Familiarity with secure token handling, JWT validation, and key management.

Responsibilities

• Analyze NestJS and TypeScript apps for authentication, authorization, input validation, and data-protection vulnerabilities.
• Establish secure patterns for NestJS: guards, interceptors, middleware, validation, logging, and error handling.
• Own or contribute to OIDC integrations and identity platform security as IdP and RP.
• Design and review OAuth 2.0 / OpenID Connect flows, PKCE, token lifetimes, and key rotation.
• Define authorization models using RBAC and policy-based controls.
• Lead threat modeling, design reviews, and secure code reviews.

Skills

Node.js

TypeScript

NestJS

OAuth 2.0 / OpenID Connect

RBAC / access control

Security testing (SAST/DAST)

Tools

Burp Suite

Semgrep

CodeQL

Snyk

Dependabot

OWASP ZAP

Job description

Vestwell is seeking a Staff Application Security Engineer to secure NestJS and TypeScript applications, focusing on authentication, authorization, and identity integrations. You will own security across OIDC flows and act as both IdP and RP within the platform.

You will collaborate with software engineering, platform, and product teams to implement secure-by-default practices, review threat models, and improve CI/CD security tooling and processes.