Staff Security Engineer, Imunify360 - CloudLinux

About CloudLinux

CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful.

We are currently hiring a Staff Security Engineer within the Imunify360 product team. Imunify360 is CloudLinux's security suite for Linux web servers, protecting hundreds of thousands of hosting servers and websites worldwide.

Role Mission & Scope

As a Staff Security Engineer, you will take end-to-end technical ownership of complex security challenges, from initial threat discovery and analysis to detection, mitigation, and post-incident review.

This is a hands-on technical leadership role focused on practical security engineering rather than SOC monitoring, compliance, or theoretical research. You will analyze malware and exploit code, build detection and mitigation tools, anticipate emerging attack techniques, and ensure security findings translate into production-ready detections, mitigations, and fixes.

As an individual contributor, you will not have direct reports or people management responsibilities. All security research and testing are conducted within authorized boundaries, with clearly defined scope and responsible disclosure practices.

What You Will Own

Malware and Campaign Mitigation

• Lead response to large-scale exploitation and malware campaigns: triage, root cause, and mitigation across every protection layer of the product.
• Reverse-engineer malware and exploits targeting Linux servers and web applications.
• Track campaigns over time: cluster indicators, connect activity to known actors and toolkits, and anticipate the next variant.
• Define and run measurable outcomes per campaign: time to detect, time to protect, cleanup effectiveness, and reinfection rate.

Security Response Coordination

• Own the security incident and response process for threats against customers and vulnerabilities in our own product (severity models, runbooks, escalation).
• Coordinate with external parties, including vendors, partners, CERTs/CSIRTs, and abuse desks, driving responsible disclosure.
• Act as the technical voice in security advisories and partner briefings.
• Triage external vulnerability reports.

Offensive Security on Our Own Product

• Red-team product and infrastructure assuming advanced attacker capabilities.
• Threat-model new features before release and manage security review gates for high-risk changes.
• Turn findings into fixes with owning teams.

Detection Engineering and Tooling

• Raise the quality bar for detections: false-positive budgets, test corpora, and staged rollouts with measurement gates.
• Build and automate the analysis pipeline: dynamic analysis, honeypots, telemetry-driven hunting, and ML-assisted triage.
• Write production code for security tooling (expect 30–50% of your time to be hands-on development).
• Turn telemetry into actionable intelligence, shared as internal briefs and selected public research.

People Multiplier

• Mentor analysts and engineers to raise the security standard across teams.
• Serve as a bar-raiser in security hiring loops.

Key Milestones

• 30 days: Analyzed real threats end-to-end; mapped response flows; shipped at least one detection or mitigation to production.
• 90 days: Published agreed security response process and severity model; led a real campaign response with a post-mortem; established baseline response metrics.
• 6 months: Measurably reduced time from first sighting to protection; completed first red-team review; established working relationships with external partners.
• 12 months: Recognized owner of security response; published research or disclosures; enabled teams to run standard campaign responses independently.

Requirements

Must Have

• 10+ years in security engineering, malware research, incident response, or offensive security, including experience leading cross-team initiatives at Staff, Principal, or Lead scope.
• Deep hands-on malware analysis and reverse engineering skills.
• Strong web application security and practical exploitation experience.
• In-depth Linux knowledge from both offensive and defensive perspectives.
• Proven incident response leadership on large-scale events, including advisories and post-mortems.
• Production programming experience in Python plus a systems language (Go, Rust, or C).
• Experience with coordinated vulnerability disclosure and the wider security community.
• Clear, concise communication skills for both technical and non-technical stakeholders, working effectively asynchronously across time zones.
• Daily user of AI tools for analysis and coding, with critical judgment about their output.

Nice to Have

• Background in web hosting or large web hosting ecosystems.
• Experience authoring detections at scale (signatures, WAF/IDS rules).
• Kernel-level monitoring and rootkit detection expertise.
• Threat intelligence practice and threat actor tracking.
• Machine learning experience for malware classification.
• Public track record: CVEs, published research, talks, CTFs, or open-source security tools.

Benefits

• Fully remote work with flexible working hours.
• Private medical insurance compensation.
• 24 paid vacation days, 10 national holidays, and unlimited sick leave.
• Co-working space and gym/sports reimbursement.
• Dedicated education budget.
• Opportunity to receive rewards for innovative patentable ideas.
• High degree of ownership, autonomy, and architectural influence.