Staff Security Engineer for Imunify360 at CloudLinux at CloudLinux

About CloudLinux

CloudLinux is a global, remote-first company driven by core principles: doing the right thing, employees first, and being remote first. We deliver high-volume, low-cost Linux infrastructure and security products designed to increase the operational efficiency of companies. Every member of our team supports each other to ensure collective success.

You can learn more about us at cloudlinux.com.

Role Mission & Scope at Imunify360

At Imunify360, protecting customers from constantly evolving cyber threats demands close collaboration between security research, engineering, and other teams. Responding to complex attack campaigns involves more than simply identifying threats; it requires understanding attack techniques, developing effective detection and mitigation strategies, and ensuring customer protection.

As a Staff Security Engineer, you will take end to end technical ownership of complex security challenges, spanning from initial threat discovery and analysis to detection, mitigation, and post incident review. This is a hands on technical leadership role focused on practical security engineering, rather than SOC monitoring, compliance, or purely theoretical research. You will analyze malware and exploit code, develop detection and mitigation tools, anticipate emerging attack techniques, and ensure security findings translate into production ready detections, mitigations, and fixes. You will work closely with engineering, security research, support, external partners, and the broader security community to coordinate responses and drive continuous improvements in our security capabilities. As an individual contributor, you will not have direct reports or people management responsibilities. All security research and testing must be conducted within authorized boundaries, adhering to clearly defined scope and responsible disclosure practices. Your mission is to strengthen Imunify360's ability to detect, prevent, and respond to emerging threats, delivering measurable security improvements that protect customers at scale.

What you will own

• Malware and Campaign Mitigation
  • Lead response to large scale exploitation and malware campaigns: triage, root cause analysis, and mitigation across every protection layer of the product.
  • Reverse engineer malware and exploits targeting Linux servers and web applications.
  • Track campaigns over time, not just individual samples: cluster indicators, connect activity to known actors and toolkits, and anticipate the next variant.
  • Define and run measurable outcomes per campaign: time to detect, time to protect, cleanup effectiveness, and reinfection rate.
• Security Response Coordination
  • Own the security incident and response process, covering both threats against our customers and vulnerabilities in our own product: severity model, runbooks, communication, and escalation.
  • Coordinate with external parties - software vendors, partners, CERTs/CSIRTs, abuse desks, and other security vendors. Drive responsible disclosure when we find vulnerabilities.
  • Be the technical voice in security advisories and partner briefings, alongside Product and Support.
  • Triage external vulnerability reports.
• Offensive Security on Our Own Product
  • Red team our product and infrastructure. Assume a capable attacker who already has a foothold.
  • Threat model new features before they ship; own the security review gate for high risk changes.
  • Turn findings into fixes with the owning teams, rather than just reports.
• Detection Engineering and Tooling
  • Raise the quality bar of detections: establishing false positive budgets, test corpora, staged rollout with measurement gates, and fast rollback capabilities.
  • Build and automate the analysis pipeline: dynamic analysis, honeypots, telemetry driven hunting, and ML assisted triage where it measurably helps.
  • Write production code for these tools; expect 30-50% of your time to be hands on building.
  • Turn telemetry into intelligence: emerging exploits, attacker infrastructure, trends - shared as internal briefs and selected public research.
• People Multiplier (No Direct Reports)
  • Mentor analysts and engineers; raise the overall security skill level across teams.
  • Act as a bar raiser in security hiring loops.

Key Milestones

• 30 days: Analyzed real threats end to end. Mapped the current response flow and identified where it breaks. Shipped at least one detection or mitigation to production.
• 90 days: Security response process and severity model published and agreed upon. Led at least one real campaign response with a written post mortem. Baseline response metrics put in place.
• 6 months: Time from first sighting to protection measurably reduced versus baseline. First red team review completed, top findings fixed. Working relationships with key external partners established.
• 12 months: Recognized internally and externally as the owner of security response. Public research or disclosures published. Teams can run a standard campaign response without your direct involvement.

Requirements

Must have

• 10+ years in security engineering, malware research, incident response, or offensive security, with several years leading cross team work at Staff, Principal, or Lead scope.
• Deep hands on malware analysis and reverse engineering skills.
• Strong web application security and practical exploitation experience.
• Deep Linux knowledge from both the attacker's and the defender's perspective.
• Proven incident response leadership on large scale events: you have run the response, written the advisory, and closed the post mortem.
• Production coding proficiency in Python plus a systems language (Go, Rust, or C).
• Experience with coordinated vulnerability disclosure and working with the security community.
• Clear, concise writing for both engineers and non technical stakeholders; capable of working well asynchronously across time zones.
• Daily use of AI tools for analysis and coding, coupled with critical judgment regarding their output.

Nice to have

• Background in hosting or large web ecosystems.
• Detection authoring at scale (signatures, WAF/IDS rules).
• Kernel level monitoring and rootkit detection.
• Threat intelligence practice and actor tracking.
• ML for malware classification.
• Public track record: CVEs, published research, talks, CTFs, or open source security tools.
• Relevant certifications are a plus, but not a requirement.

Benefits

What's in it for you?

• Stay hands on technically while owning complex, high impact engineering work.
• Work on challenging Linux, automation, and cybersecurity problems across mature and newer products.
• Influence technical direction and make meaningful architectural decisions.
• Work independently with a high level of ownership and autonomy.
• Fully remote work with flexible working hours.
• 24 paid vacation days, 10 national holidays, and unlimited sick leave.
• Private medical insurance compensation.
• Reimbursement for co working and gym/sports.
• Education budget.
• Opportunity to receive a reward for innovative ideas that the company can patent.

By applying for this position, you consent to the processing of your personal data as described in our Privacy Policy (https://cloudlinux.com/candidate-privacy-notice), which provides detailed information on how we maintain and handle your data.