Staff AppSec Engineer - NestJS & OAuth/OIDC Expert

Cybersecurity Jobs; King of Prussia (PA); Hybrid; USD 190,000 - 200,000; Full time

Benefits offered by this job

Health benefits

Generous time off

401(k) plan

Employee Wellbeing Committee

Hybrid work model

Job summary

Vestwell is seeking a Staff Application Security Engineer to strengthen the security of NestJS applications and identity integrations that support OAuth 2.0 and OpenID Connect.

The role spans application security across the SDLC with ownership of security architecture for identity platform capabilities, collaborating with engineering and platform teams. Hybrid work options are available in Midtown Manhattan, Austin, King of Prussia, and Scottsdale.

Qualifications

• Strong experience securing Node.js and TypeScript applications; hands-on NestJS experience preferred.
• Deep understanding of OAuth 2.0 and OpenID Connect, incl. deployment patterns.
• Experience with IdP/RP implementations, integrations, or security assessments.
• Knowledge of RBAC, least privilege, scopes, permissions, sessions, and tokens.
• Familiarity with CI/CD integration of security into developer workflows.

Responsibilities

• Analyze NestJS and TypeScript apps for vulnerabilities in authentication, authorization, input validation, and data protection.
• Develop secure NestJS patterns including guards, interceptors, and decorators.
• Own or contribute to security architecture for OIDC integrations as identity provider or relying party.
• Review OAuth 2.0 and OpenID Connect flows including PKCE and token lifetimes.
• Lead or participate in threat modeling, security design reviews, and secure code reviews.
• Improve security testing and detection with SAST, DAST, and software composition analysis.

Skills

NestJS

TypeScript

Node.js

OAuth 2.0

OpenID Connect

RBAC

JWT

CI/CD

Threat modeling

Secure coding

Tools

Burp Suite

Semgrep

CodeQL

Snyk

Dependabot

OWASP ZAP

Job description

Vestwell is seeking a Staff Application Security Engineer to strengthen the security of NestJS applications and identity integrations that support OAuth 2.0 and OpenID Connect.

The role spans application security across the SDLC with ownership of security architecture for identity platform capabilities, collaborating with engineering and platform teams. Hybrid work options are available in Midtown Manhattan, Austin, King of Prussia, and Scottsdale.