Senior ML Engineer - Malware Detection (remote work)

CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful.

Check out our website for more information: https://cloudlinux.com/

Imunify360 is CloudLinux's security suite for Linux web servers: real-time and background malware scanning, automated cleanup, a WAF, runtime PHP protection (Proactive Defense), a database malware scanner, and IP reputation. It runs on hosting providers' shared, VPS, and dedicated servers, so new web-malware campaigns land on our fleet early.

We sit on one of the largest labeled corpora of live web-server malware in the industry: files, verdicts, cleanup outcomes, and analyst decisions collected from production hosting servers every day. It already drives our signatures, heuristics, and ML models, and there is far more to get out of it. We are looking for a Senior ML Engineer who will turn that data into detection that ships — classifiers, LLM-assisted triage and generated signatures — and keep exploring new ML/LLM methods against it, measured by the product's false-negative and false-positive rates, not by notebook accuracy.

Our dataset focuses on web malware — PHP, JavaScript, HTML phishing kits, infected WordPress and Joomla plugins and themes, database injections — with the context around each file.

What you'll work with:

• Malware samples from production servers, with verdicts and analyst decisions

• Years of signatures and detection rules

• Customer-reported false negatives and false positives

• Runtime behavior of code on live sites

• Web-attack traffic

• File metadata and how files spread across servers

• Cleanup outcomes, including what came back

What you will do:

The goal is 10x more malware…