Application Security Engineer
Core
Securing NestJS and TypeScript applications, identity integrations (OAuth/OIDC), and API security for a financial technology platform.
Role type
mid-level IC application security engineer
Builds
secure authentication/authorization flows, secure code practices, and threat models for web/APIs
Domain
fintech + application security
Required skills
Node.js, TypeScript, NestJS, OAuth 2.0, OpenID Connect, JWT, RBAC, OWASP Top 10, SAST/DAST, CI/CD integration, threat modeling, secure code review
Preferred skills
Auth0/Okta/Keycloak/Cognito/Azure AD, SAML, API gateways, microservices, cloud-native, containers, IaC, secrets management, Burp Suite, Semgrep, CodeQL, Snyk, OWASP ASVS, NIST SSDF
Technologies
Azure, CI/CD, Cloud IAM, JWT, NestJS, OWASP, OAuth, OpenID, RBAC, SAML, TypeScript, Web, microservices, NodeJS
Responsibilities
Assess NestJS/TypeScript apps for auth/authorization/input validation/injection/session/API/business logic/data protection weaknesses; Develop secure NestJS practices (guards, interceptors, middleware, validation, error handling, logging, config, dependency management); Review and secure OIDC integrations (IdP/RP endpoints, flows, token exchange, sessions, logout); Implement/maintain RBAC and claims/policy-based authorization; Participate in threat modeling, security design/architecture reviews, and secure code reviews; Create security requirements, reusable libraries, reference implementations, and developer guidance; Support security testing (SAST, DAST, SCA, secret scanning, API testing, dependency monitoring) and assessments; Work with engineering teams to remediate vulnerabilities and confirm fixes; Monitor security signals, assist in incident investigations, and maintain playbooks; Maintain security documentation, standards, risk exceptions, and audit evidence; Stay current on app/identity security, OAuth/OIDC, browser/API security, cloud security, and emerging attacks
Seniority
Mid-level, hands-on IC