Lead Security Engineer - Vulnerability Response (Imunify360)

About CloudLinux & Imunify360

CloudLinux is a global remote-first company driven by principles: do the right thing, employees first, and remote first. We deliver high-volume, low-cost Linux infrastructure and security products that help companies increase operational efficiency.

Imunify360 Security Suite is an innovative security solution designed specifically for shared and VPS/Dedicated servers, providing a six-layer approach to automated and comprehensive attack prevention.

The Challenge

When a critical vulnerability in a popular web application or WordPress plugin goes public, attackers exploit it within hours. Our goal is to protect customers before the first attack reaches them.

• AI-driven vulnerability response: Build and run a pipeline that detects new high and critical vulnerabilities, generates WAF rules with AI assistance, validates them, and ships them to production in a short window.
• Protection plus public announcement: The same pipeline that ships the rule produces the public advisory so customers see that Imunify closed it first.
• Build on what works: Extend our existing AI-assisted pipeline for our WordPress protection plugin to ModSecurity/Coraza WAF rules.
• Speed without breaking sites: Balance fast protection with precision to avoid customer incidents on shared hosting.
• Make it measurable: Own metrics including time-to-protection, coverage of critical vulnerabilities, and false-positive rate.

What You'll Do

• Design and build the AI-driven pipeline from disclosure to announcement: intake, triage, rule drafting, testing, release, and public advisory.
• Lead the extension of our existing WordPress-plugin pipeline to ModSecurity/Coraza rules.
• Write and review WAF rules (ModSecurity/SecLang) for real-world web vulnerabilities.
• Build test harnesses that check rules against exploits and real traffic before release.
• Lead and mentor security analysts: set priorities, review work, and remove blockers.
• Define and track time-to-protection, coverage, and false-positive rates.
• Automate advisory generation as part of the pipeline and coordinate review flows with marketing.

Requirements

• 5+ years in web/application security: vulnerability research, detection engineering, WAF engineering, or similar.
• Deep understanding of web attack classes (SQLi, XSS, RCE, auth bypass, path traversal, file upload, deserialization) and detection in HTTP traffic.
• Hands-on experience writing WAF rules (ModSecurity/SecLang, OWASP CRS, or similar) and regular expressions.
• Ability to read PHP code and understand vulnerabilities from advisories or patch diffs.
• Strong Python skills with experience building production automation pipelines, CI/CD, and automated testing.
• Hands-on daily use of AI/LLM tools with practical verification of output.
• Proven track record of leading technical projects end to end.
• Product mindset focused on customer impact.
• Upper-intermediate English proficiency or better.

Nice to Have

• WordPress ecosystem security (plugin vulnerabilities, feeds like Wordfence, Patchstack, WPScan, CVE credits, bug bounty).
• Coraza or other WAF engines.
• Exploit analysis or threat intelligence background.
• Linux server administration and hosting industry experience.

Personal Skills

• Strong ownership: take goals and run with them.
• Ability to see the whole process and find bottlenecks.
• Clear communication and early risk escalation.
• Calm under pressure during critical vulnerability events.
• Comfortable making decisions with incomplete information.

What's in It for You

• Focus on professional development and interesting, challenging projects.
• Fully remote work with flexible working hours from any location worldwide.
• 24 days of paid vacation per year, 10 national holidays, and unlimited sick leave.
• Compensation for private medical insurance.
• Co-working and gym/sports reimbursement.
• Budget for education.
• Opportunity to receive a reward for patentable innovative ideas.