Senior ML Engineer - Malware Detection

About CloudLinux

CloudLinux is a global remote-first company driven by our principles: do the right thing, employees first, and we deliver high-volume, low-cost Linux infrastructure and security products. Every person on our team supports each other to ensure we all are successful.

Imunify360 is CloudLinux's security suite for Linux web servers: real-time and background malware scanning, automated cleanup, WAF, runtime PHP protection, database malware scanner, and IP reputation. We sit on one of the largest labeled corpora of live web-server malware in the industry.

We are looking for a Senior ML Engineer to turn that data into detection that ships—classifiers, LLM-assisted triage, and generated signatures—measured by the product's false-negative and false-positive rates.

What You Will Do

• Decide which files on a server deserve a closer look, within tight CPU and memory budgets.
• Tell malicious code from benign at fleet scale and a sensible cost per file.
• Generate detection signatures automatically from new campaigns.
• Catch malware that only looks malicious in context, such as phishing pages and script injections.
• Route each file to the right detection engine and make cleanup precise.
• Prove each model improves detection before it ships.

What You'll Deliver

• First month: A first model trained on production data and measured against today's engines. Evaluation harness in place with splits by time and campaign.
• By month 3: Several models in production (shadow mode and live), gated on the past-error regression set. Written proposal (ADR) for the detection cascade.
• By month 12: Models as a main source of new detections, retraining on fresh analyst labels on a fixed cadence, and generated signatures inside the analyst workflow.

What You Bring

• 5+ years building ML systems in production, including 2+ in an adversarial domain (security, abuse, fraud, or spam).
• Experience training and fine-tuning transformer models yourself (data prep, tokenizing code, LoRA/QLoRA, distillation, quantization).
• Classic ML depth: gradient boosting, linear models on sparse features, calibration, class imbalance.
• Evaluation discipline: leakage-free splits by time and family, precision at a fixed false-positive budget.
• Inference cost engineering: measuring throughput, latency, and fitting models to CPU/memory budgets (ONNX, llama.cpp, vLLM).
• Strong Python, PyTorch, Hugging Face stack, and SQL on large analytical tables.
• Familiarity with PHP or JavaScript, or willingness to learn.
• Daily use of AI coding agents and ability to demonstrate how.
• English at upper-intermediate (B2) level or higher with strong written communication for async work.

Benefits

• Fully remote work with flexible working hours from any location worldwide.
• 24 days of paid vacation per year, 10 days of national holidays, and unlimited sick leave.
• Compensation for private medical insurance.
• Co-working and gym/sports reimbursement.
• Budget for education.
• Innovation and patent reward opportunities.