Senior Machine Learning Engineer, Malware Detection at CloudLinux

About CloudLinux

CloudLinux is a global remote first company guided by four principles: do the right thing, employees first, we are remote first, and we deliver high volume, low cost Linux infrastructure and security products that help companies increase operational efficiency. Every team member supports each other and works to ensure collective success.

About Imunify360

Imunify360 is CloudLinux's security suite for Linux web servers. It provides real time and background malware scanning, automated cleanup, a web application firewall, runtime PHP protection through Proactive Defense, a database malware scanner, and IP reputation. It runs on hosting providers' shared, VPS, and dedicated servers, so new web malware campaigns reach the fleet early.

The team sits on one of the largest labeled corpora of live web server malware in the industry: files, verdicts, cleanup outcomes, and analyst decisions collected daily from production hosting servers. This data already drives signatures, heuristics, and machine learning models, and there is far more value to extract.

Role Overview

CloudLinux is seeking a Senior Machine Learning Engineer who will turn this data into detection that ships, including classifiers, LLM assisted triage, and generated signatures, and keep exploring new ML and LLM methods against it. Success is measured by the product's false negative and false positive rates, not by notebook accuracy.

The dataset focuses on web malware such as PHP, JavaScript, HTML phishing kits, infected WordPress and Joomla plugins and themes, and database injections, with the context around each file.

What You Will Work With

• Malware samples from production servers, with verdicts and analyst decisions
• Years of signatures and detection rules
• Customer reported false negatives and false positives
• Runtime behavior of code on live sites
• Web attack traffic
• File metadata and how files spread across servers
• Cleanup outcomes, including what came back

What You Will Do

The goal is 10x more malware detected at the same or lower false positive rate. Hand written rules and faster pipelines will not get there; models trained on the data might.

• Decide which files on a server deserve a closer look, within tight CPU and memory budgets
• Tell malicious code from benign at fleet scale and a sensible cost per file
• Generate detection signatures automatically from new campaigns
• Catch malware that only looks malicious in context, such as phishing pages and script injections
• Route each file to the right detection engine
• Make cleanup precise so sites stay clean afterwards
• Prove each model improves detection before it ships

How We Work

You get an experimentation track, GPUs, and a direct line to leadership; in return, you bring numbers, not opinions.

• Remote first, async across UTC-5 to UTC+8. Decisions are written down (ADR-Lite) and public by default.
• Hardware follows evidence: each training direction starts with dedicated GPUs on our own bare metal; leadership has committed to fund more when the case is made with data.
• Agentic engineering: Claude and Codex are the default tools, wired to GitLab, Jenkins, Redash, Jira, and Slite through MCP servers. We look at how engineers work with agents, including context, specificity, and review quality, not only at output.
• Close to ground truth: you work daily with malware analysts, detection and infrastructure engineers, and the rest of the ML team.
• Ship gates: no model or build goes out if it raises false positives or false negatives on our past error sets. Blameless post mortems within 24 hours.

What You Will Deliver

You own the path from raw samples to a model in production, and the numbers that prove it helped.

• First month: a first model trained on production data and measured against today's engines, either suspicious file triage or a metadata model. The evaluation harness in place: splits by time and campaign so families do not leak, and a regression set from past false positives and false negatives.
• By month 3: several models in production, some in shadow mode building evidence, some live and producing real detections, all gated on the past error regression set. A training setup that keeps its GPUs busy. A written proposal (ADR) for the detection cascade, with cost per file and hardware needs.
• By month 12: models are a main source of new detections, reported as share of new detections and false negative rate trend. Retraining on fresh analyst and false negative labels on a fixed cadence. Generated signatures inside the analyst workflow. Two or three parallel training directions that other engineers can run with your tooling.

Requirements

What You Bring

• 5+ years building ML systems that ran in production, including 2+ years in an adversarial domain: security, abuse, fraud, or spam.
• You have trained and fine tuned transformer models yourself, including data preparation, tokenizing code, LoRA/QLoRA or full fine tunes, distillation, and quantization, not only called hosted APIs.
• Classic ML depth: gradient boosting, linear models on sparse features, calibration, class imbalance, and judgement on when these beat an LLM.
• Evaluation discipline: leakage free splits by time and family, precision at a fixed false positive budget, regression sets, and an honest account of why production will differ from offline.
• Inference cost engineering: you have measured throughput and latency and made a model fit a CPU or memory budget (ONNX, llama.cpp, vLLM, int8/int4).
• Strong Python, PyTorch and the Hugging Face stack; SQL on large analytical tables (ClickHouse or similar).
• Familiarity with PHP or JavaScript, or willingness to pick it up working with our malware analysts.
• You use AI coding agents daily and can show how.
• English at upper intermediate (B2) level or higher, with particularly strong written communication for async work.

Strong Plus If You Have

• Web malware, webshells, phishing kits or WordPress security experience.
• Models over code: AST or token features, code LLMs, graph models on program structure.
• Malware clustering and similarity analysis.
• Multi GPU training on your own bare metal; MLflow or Weights & Biases; dataset versioning.
• Go or Rust, for on server inference.
• Published work or talks on ML for security.

Benefits

• A focus on professional development.
• Interesting and challenging projects.
• Fully remote work with flexible working hours, allowing you to schedule your day and work from any location worldwide.
• Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leave.
• Compensation for private medical insurance.
• Co-working and gym or sports reimbursement.
• Budget for education.
• The opportunity to receive a reward for the most innovative idea that the company can patent.

Privacy Notice

By applying for this position, you consent to the processing of your personal data as described in our Privacy Policy, which provides detailed information on how we maintain and handle your data.