Lead Security Engineer - Vulnerability Response (Imunify360)

Cloudlinux

3d • Remote

About The Position

CloudLinux is a global remote-first company that develops Linux infrastructure and security products. Imunify360 Security Suite provides automated, layered security for shared and VPS/dedicated servers.

The Lead Security Engineer - Vulnerability Response will own and build an end-to-end, AI-assisted vulnerability response pipeline. The pipeline will detect newly disclosed high- and critical-severity vulnerabilities, triage them, draft and test WAF rules, release protections, and generate public advisories. The role’s initial major project is extending the existing WordPress protection plugin pipeline to ModSecurity/Coraza WAF rules. The work must balance rapid protection with accuracy to avoid blocking legitimate traffic. The position owns metrics including time-to-protection, coverage of critical vulnerabilities, and false-positive rate.

The role leads a small team of security analysts and collaborates with automation, QA, and marketing. It combines web application security expertise, production automation, technical leadership, and product thinking. The position is fully remote with flexible working hours.

Requirements

• At least 5 years of experience in web/application security, such as vulnerability research, detection engineering, or WAF engineering.
• Deep understanding of web attack classes, including SQL injection, XSS, RCE, authentication bypass, path traversal, file upload, and deserialization, and how to detect them in HTTP traffic.
• Hands-on experience writing WAF rules, such as ModSecurity/SecLang or OWASP CRS rules, and using regular expressions.
• Ability to read PHP code and understand vulnerabilities from advisories or patch diffs.
• Strong Python skills and experience building production automation pipelines.
• Experience with CI/CD and automated testing.
• Daily hands-on use of AI/LLM tools, with the ability to evaluate their output and know when to trust it.
• Proven ability to lead a technical project end to end.
• Product mindset, including reasoning about customer impact as well as technical correctness.
• Upper-intermediate English or better.
• Strong ownership, process awareness, and ability to identify bottlenecks.
• Clear communication and willingness to raise risks early.
• Calm under pressure and comfortable making decisions with incomplete information.

Nice To Haves

• WordPress ecosystem security experience, including plugin vulnerabilities or vulnerability feeds such as Wordfence, Patchstack, or WPScan.
• CVE credits or bug bounty experience.
• Experience with Coraza or other WAF engines.
• Exploit analysis or threat intelligence background.
• Linux server administration or hosting industry experience.

Responsibilities

• Design and build the AI-driven pipeline from vulnerability disclosure through intake, triage, rule drafting, testing, release, and public advisory.
• Extend the existing WordPress-plugin vulnerability protection pipeline to ModSecurity/Coraza rules.
• Write and review ModSecurity/SecLang WAF rules for real-world web vulnerabilities.
• Build test harnesses that validate rules against exploits and real traffic before release.
• Lead and mentor security analysts, set priorities, review work, and remove blockers.
• Define, track, and improve time-to-protection, critical vulnerability coverage, and false-positive rate.
• Automate public advisory generation as part of the pipeline and coordinate the format and review flow with marketing.

Benefits

• Professional development focus and an education budget.
• Interesting and challenging projects.
• Fully remote work from any location worldwide, with flexible working hours.
• 24 paid vacation days per year, 10 national holidays, and unlimited sick leave.
• Compensation for private medical insurance.
• Co-working and gym/sports reimbursement.
• Opportunity to receive a reward for the most innovative idea the company can patent.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed