Staff Application Security Engineer

Required

• Professional experience in application security, product security, software engineering, or a closely related discipline.
• Strong experience securing Node.js and TypeScript applications; hands-on experience with NestJS is required or highly preferred.
• Deep understanding of OAuth 2.0 and OpenID Connect, including common implementation pitfalls and secure deployment patterns.
• Practical experience with both IdP and RP implementations, integrations, or security assessments.
• Strong understanding of authentication and authorization concepts, including RBAC, least privilege, separation of duties, claims, scopes, permissions, sessions, tokens, and service-to-service access.
• Ability to review code and architecture across APIs, web applications, background jobs, and distributed services.
• Experience with web and API security risks, including OWASP Top 10, OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, insecure deserialization, request forgery, misconfiguration, and supply-chain risk.
• Familiarity with secure token handling, JWT validation, key management, JWKS, signing algorithms, rotation, revocation, and token storage considerations.
• Experience integrating security into CI/CD and developer workflows without creating unnecessary friction.
• Strong communication skills and the ability to explain security risks and tradeoffs to both technical and non-technical audiences.
• A pragmatic, collaborative approach: you can identify meaningful risk, propose proportional controls, and help teams implement them.
• Experience with OAuth 2.1 guidance, FAPI, PAR, JAR, DPoP, sender-constrained tokens, or other advanced OAuth security patterns.