Senior ML Engineer - Malware Detection (remote work)

Cloudlinux

1d • Remote

About The Position

CloudLinux is a global, remote-first company that develops Linux infrastructure and security products. Its Imunify360 security suite protects Linux web servers with malware scanning, automated cleanup, a web application firewall, runtime PHP protection, database malware scanning, and IP reputation services. The product operates on hosting providers’ shared, VPS, and dedicated servers and collects a large, labeled corpus of live web-server malware, verdicts, cleanup outcomes, and analyst decisions.

CloudLinux is seeking a Senior ML Engineer to turn this production data into deployable detection systems, including classifiers, LLM-assisted triage, and automatically generated signatures. The role also explores new ML and LLM methods, with success measured by product false-negative and false-positive rates rather than offline notebook accuracy. The data covers web malware such as PHP and JavaScript malware, HTML phishing kits, infected WordPress and Joomla plugins and themes, and database injections, along with contextual information about files and their behavior.

The engineer will own the path from raw samples to production models and demonstrate their impact. Initial work includes training a model on production data and establishing an evaluation harness with time- and campaign-based splits and regression sets for past false positives and false negatives. Over time, the role is expected to put multiple models into production, propose a detection cascade with its costs and hardware needs, and make models a significant source of new detections. The position works closely with malware analysts, detection and infrastructure engineers, and the ML team.

The company describes its work as remote-first and asynchronous across UTC−5 to UTC+8, with written decisions, dedicated GPU resources for experimentation, and leadership support for additional hardware when justified by evidence. AI coding agents are part of the engineering workflow, and model releases are gated against past-error sets. The team conducts blameless post-mortems within 24 hours.

Requirements

• At least 5 years building ML systems that have run in production, including at least 2 years in an adversarial domain such as security, abuse, fraud, or spam.
• Hands-on experience training and fine-tuning transformer models, including data preparation, code tokenization, LoRA/QLoRA or full fine-tuning, distillation, and quantization; experience must go beyond calling hosted APIs.
• Strong classic ML knowledge, including gradient boosting, linear models on sparse features, calibration, class imbalance, and judgment about when these methods outperform an LLM.
• Disciplined model evaluation, including leakage-free splits by time and family, precision at a fixed false-positive budget, regression sets, and an understanding of how production outcomes can differ from offline evaluation.
• Experience measuring inference throughput and latency and fitting models within CPU or memory budgets, using approaches or tools such as ONNX, llama.cpp, vLLM, int8, or int4.
• Strong Python, PyTorch, and Hugging Face skills.
• Experience with SQL on large analytical tables, using ClickHouse or a similar system.
• Familiarity with PHP or JavaScript, or willingness to learn one while working with malware analysts.
• Daily use of AI coding agents and ability to demonstrate how they are used.
• English proficiency at upper-intermediate (B2) level or higher, with strong written communication for asynchronous work.

Nice To Haves

• Experience with web malware, webshells, phishing kits, or WordPress security.
• Experience building models over code, including AST or token features, code LLMs, or graph models of program structure.
• Experience with malware clustering and similarity analysis.
• Multi-GPU training on bare-metal hardware, and experience with MLflow or Weights & Biases and dataset versioning.
• Go or Rust experience for on-server inference.
• Published work or talks on ML for security.

Responsibilities

• Build and deploy ML-based malware detection systems using production malware samples, verdicts, analyst decisions, and related data.
• Decide which server files warrant closer inspection while staying within CPU and memory budgets.
• Classify malicious and benign code at fleet scale while maintaining a sensible cost per file.
• Generate detection signatures automatically from new malware campaigns.
• Detect malware that is malicious in context, including phishing pages and script injections.
• Route files to the appropriate detection engine.
• Improve cleanup precision so that sites remain clean after remediation.
• Demonstrate that each model improves detection before release, using false-negative and false-positive measures and regression sets.
• Own the process from raw samples through production deployment and report evidence of the models’ impact.
• Create and maintain an evaluation harness with time- and campaign-based splits that prevent family leakage, plus regression sets based on past false positives and false negatives.
• Develop models for production, including shadow-mode models and live models that generate detections.
• Keep the training setup and available GPUs effectively utilized.
• Write a proposal for the detection cascade, including cost per file and hardware requirements.
• Retrain models on fresh analyst and false-negative labels on a fixed cadence.
• Integrate generated signatures into the analyst workflow and provide tooling for other engineers to run parallel training directions.

Benefits

• Professional development focus.
• Interesting and challenging projects.
• Fully remote work with flexible hours and the ability to work from any location worldwide.
• 24 paid vacation days per year, 10 national holidays, and unlimited sick leave.
• Compensation for private medical insurance.
• Co-working and gym or sports reimbursement.
• Education budget.
• Opportunity to receive a reward for an innovative idea the company can patent.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed