About the role

What you’ll do

• Analyze vulnerabilities in applications and identity integrations
• Strengthen secure development practices
• Support OIDC identity capabilities with engineering, platform, infrastructure, and product teams
• Review code across APIs, web applications, and background jobs
• Explain security findings and risk to technical teammates
• Propose and implement proportional security controls

What you’ll need

• 2-4 years of professional experience in application security, product security, software engineering, or a closely related discipline
• Experience securing Node.js and TypeScript applications
• Working knowledge of OAuth 2.0 and OpenID Connect concepts and common implementation pitfalls
• Solid understanding of authentication and authorization concepts including RBAC, least privilege, claims, scopes, permissions, sessions, and tokens
• Familiarity with web and API security risks including OWASP Top 10, OWASP API Security Top 10, broken access control, SSRF, injection, XSS, CSRF, and misconfiguration
• Basic understanding of secure token handling, JWT validation, JWKS, signing algorithms, and token storage considerations

Original job description