Staff Security Engineer at CloudLinux

Role Overview - Staff Security Engineer at Imunify360

CloudLinux is a global remote-first company dedicated to delivering high-volume, low-cost Linux infrastructure and security products. We operate under the principles of doing the right thing and putting employees first. We are currently seeking a Staff Security Engineer to join the Imunify360 product team. Imunify360 is our security suite for Linux web servers, protecting hundreds of thousands of hosting servers from large-scale web attacks.

Mission and Scope

At Imunify360, effectively protecting customers from evolving cyber threats demands tight collaboration between security research, engineering, and various other teams. Responding to complex attack campaigns requires more than just identifying threats; it involves understanding attack techniques, developing effective detection and mitigation strategies, and ensuring customer protection. As a Staff Security Engineer, you will take end-to-end technical ownership of complex security challenges, ranging from initial threat discovery and analysis to mitigation and post-incident review.

This is a hands-on technical leadership role focused on practical security engineering, not SOC monitoring, compliance, or purely theoretical research. Your responsibilities include analyzing malware and exploit code, developing detection and mitigation tools, anticipating new attack techniques, and ensuring security findings translate into production-ready detections, mitigations, and fixes. You will collaborate closely with engineering, security research, support, external partners, and the wider security community to drive continuous improvements in our security capabilities.

As an individual contributor, you will not have direct reports or people management responsibilities. All security research and testing must be conducted within authorized boundaries, following clear scope and responsible disclosure practices. Your primary mission is to significantly strengthen Imunify360's ability to detect, prevent, and respond to emerging threats, delivering measurable security improvements that protect customers at scale.

What You Will Own

• Malware and Campaign Mitigation: Lead responses to large-scale exploitation and malware campaigns by triaging, finding root causes, and mitigating across every protection layer of the product. This includes reverse engineering malware and exploits targeting Linux servers and web applications. You will track campaigns over time, clustering indicators and connecting activity to known actors, while defining measurable outcomes per campaign such as time to detect and time to protect.
• Security Response Coordination: Own the security incident and response process for threats against our customers and vulnerabilities within our own product. This involves defining severity models, creating runbooks, managing communication, and escalation. You will coordinate with external parties like software vendors, partners, CERTs/CSIRTs, and abuse desks, driving responsible disclosure when vulnerabilities are found, and acting as the technical voice in advisories.
• Offensive Security on Our Own Product: Perform red-teaming on our product and infrastructure, assuming an attacker who already has a foothold. You will threat model new features before they ship, owning the security review gate for high-risk changes, and transforming findings into fixes with the owning teams.
• Detection Engineering and Tooling: Raise the quality bar of detections by managing false-positive budgets and deploying staged rollouts with measurement gates. You will build and automate the analysis pipeline, utilizing dynamic analysis, honeypots, and ML-assisted triage where it provides measurable help. A significant portion of your time (30-50%) will be hands-on building production code for these tools.
• People Multiplier: While you have no direct reports, you are expected to mentor analysts and engineers and serve as a bar-raiser during security hiring loops to raise the overall security skill level across teams.

Key Milestones

• 30 days: Analyze real threats end-to-end, map the current response flow and its bottlenecks, and ship at least one detection or mitigation to production.
• 90 days: Establish and agree upon the security response process and severity model. Lead at least one real campaign response documented with a written post-mortem and establish baseline response metrics.
• 6 months: Measurably reduce the time from first sighting to protection versus the established baseline. Complete the first red-team review with top findings remediated. Build strong working relationships with key external partners.
• 12 months: Be recognized internally and externally as the primary owner of security response. Ensure teams can run a standard campaign response independently of your direct involvement.

Requirements

Must Have

• 10+ years of experience in security engineering, malware research, incident response, or offensive security, including several years leading cross-team efforts at a Staff, Principal, or Lead scope.
• Deep, hands-on expertise in malware analysis and reverse engineering.
• Strong practical experience in web application security and exploitation.
• In-depth Linux knowledge from both an attacker's and a defender's perspective.
• Proven incident response leadership on large-scale events, including running the response, writing the advisory, and closing the post-mortem.
• Production coding experience in Python combined with a systems language such as Go, Rust, or C.
• Experience managing coordinated vulnerability disclosure and interacting with the security community.
• Strong ability to write clear, concise communication for both technical engineers and non-technical stakeholders, succeeding well asynchronously across different time zones.
• Daily use of AI tools for analysis and coding, paired with critical judgment regarding their output.

Nice to Have

• Experience within hosting environments or large web ecosystems.
• Expertise in large scale detection authoring, such as signatures or WAF/IDS rules.
• Knowledge of kernel-level monitoring and rootkit detection.
• Practice with threat intelligence gathering and actor tracking.
• Experience using Machine Learning for malware classification.
• A public track record including CVEs, published research, conference talks, CTFs, or open source security tools.
• Relevant certifications are a bonus but not required.

Benefits and Compensation

In this role, you will benefit from:

• Staying highly hands-on technically while owning complex, high-impact engineering work.
• Working on challenging problems in Linux, automation, and cybersecurity across both mature and newer products.
• Having the influence to direct technical strategy and make meaningful architectural decisions.
• Working with a high degree of ownership and autonomy in an independent capacity.
• Fully remote work with flexible working hours.
• 24 paid vacation days, 10 national holidays, and unlimited sick leave.
• Private medical insurance compensation.
• Reimbursement for co-working space and gym/sports memberships.
• An education budget for professional development.
• Opportunities to receive a reward for innovative ideas that the company can patent.

By applying, you consent to the processing of your personal data as detailed in the CloudLinux Privacy Policy.

Apply for this job