Lead Security Engineer - Vulnerability Response at CloudLinux

About CloudLinux

CloudLinux is a global remote-first company driven by principles: doing the right thing, employees first, and being remote first. We deliver high-volume, low-cost Linux infrastructure and security products that increase company operational efficiency. Every team member supports each other to ensure collective success. Learn more at cloudlinux.com.

Imunify360 Security Suite is an innovative security solution designed for shared and VPS/Dedicated servers. It uses a six-layer approach to deliver comprehensive, complete attack prevention.

The Challenge Ahead

When critical vulnerabilities in popular web applications or WordPress plugins are disclosed, attackers begin exploiting them within hours. Most site owners cannot patch this fast enough. Our mission is to protect our customers before the first attack lands and to ensure they are aware of our intervention.

We are hiring for the Lead Security Engineer - Vulnerability Response role to tackle this challenge through:

• AI-driven vulnerability response. Building and operating a pipeline that detects new high and critical vulnerabilities, generates WAF rules with AI assistance, validates them, and ships them to production within a short window.
• Protection plus public announcement, automated. The same pipeline that ships the rule will also produce the public advisory. Every critical vulnerability we cover will be announced shortly after the rule deployment, letting customers and the market know that Imunify has mitigated the risk first.
• Building upon existing solutions. We will extend the AI-assisted pipeline currently running for our WordPress protection plugin to cover ModSecurity/Coraza WAF rules.
• Achieving speed without breaking functionality. On shared hosting, a rule blocking legitimate traffic results in a customer incident. Precision and speed are equally vital.
• Measurable impact. This role is responsible for owning metrics such as time-to-protection, coverage of critical vulnerabilities, and false positive rate.

About the Role

You will own the vulnerability response pipeline from end to end and serve as its primary builder. You must combine deep web application security knowledge with strong automation skills, always maintaining a product mindset regarding customer needs, measurement, and future development.

As a leader, you will guide a small team of security analysts, working closely with automation, QA, and marketing teams.

What You Will Do

• Design and build the end to end AI-driven pipeline, covering vulnerability intake, triage, rule drafting, testing, release, and public advisory generation.
• Lead the extension of our existing WordPress-plugin pipeline to support ModSecurity/Coraza rules.
• Write and review WAF rules using ModSecurity/SecLang for real-world web vulnerabilities.
• Develop test harnesses to verify rules against exploits and actual traffic before release.
• Lead and mentor security analysts, setting priorities, reviewing their submissions, and resolving blockers.
• Define, track, and improve metrics including time-to-protection, coverage, and false-positive rate.
• Automate advisory generation as part of the pipeline and coordinate the format and review process with the marketing department.

Requirements

What we are looking for:

• Five or more years of experience in web or application security, focusing on vulnerability research, detection engineering, WAF engineering, or a similar discipline.
• A deep understanding of common web attack classes (SQLi, XSS, RCE, auth bypass, path traversal, file upload, deserialization) and their detection methods within HTTP traffic.
• Practical experience writing WAF rules using ModSecurity/SecLang, OWASP CRS, or equivalent tools, along with regular expressions.
• Ability to read PHP code and identify vulnerabilities from security advisories or patch differences.
• Strong Python skills, specifically in building automation pipelines that operate in production environments, including CI/CD and automated testing frameworks.
• Hands-on daily usage of AI/LLM tools, including knowing their limitations and how to rigorously verify their output.
• A documented history of successfully leading a technical project to completion.
• A product mindset, focusing on customer impact beyond mere technical correctness.
• Upper-intermediate English proficiency or higher.

Nice to have:

• Knowledge of the WordPress ecosystem security, including plugin vulnerabilities, vulnerability feeds (Wordfence, Patchstack, WPScan), CVE credits, or bug bounty participation.
• Familiarity with Coraza or other WAF engines.
• Background in exploit analysis or threat intelligence.
• Experience with Linux server administration or the hosting industry.

Personal Skills:

• Strong ownership, taking full responsibility for goals rather than just tasks.
• Holistic problem solving, identifying bottlenecks across the entire process, not just fixing isolated issues.
• Clear communication and proactive risk escalation.
• Composure under pressure, as critical vulnerabilities require immediate attention.
• Comfort in making sound decisions even when information is incomplete.

Benefits

What's in it for you?

• A dedicated focus on professional development.
• Exposure to interesting and challenging technical projects.
• Truly remote work with flexible hours, allowing you to structure your day and work from any location worldwide.
• Paid time off including 24 days of vacation per year, 10 national holidays, and unlimited sick leave.
• Compensation for private medical insurance.
• Reimbursement for co-working spaces and gym/sports memberships.
• Budget allocated for education and learning.
• The potential to be rewarded with company equity for developing the most innovative idea patentable by the company.

By applying for this position, you consent to the processing of your personal data as detailed in our Privacy Policy (https://cloudlinux.com/candidate-privacy-notice).

Apply Now

Apply for this job.