Senior ML Engineer – Malware Detection

🔥 0 minutes ago

🌐 Poland, Spain, +4 more countries – Remote

🇵🇱 Poland – Remote 🇪🇸 Spain – Remote 🇬🇪 Georgia – Remote 🇧🇬 Bulgaria – Remote 🇦🇲 Armenia – Remote 🇲🇪 Montenegro – Remote

⏰ Full Time

🟠 Senior

🤖 Machine Learning Engineer

👻 Ghost score 10%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

CloudLinux

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2009

☁️ SaaS

🔐 Security

🌐 Web 3

SaaS • Security • Web 3

CloudLinux is a leading provider of operating systems designed specifically for web hosting environments. The company offers a line of products including CloudLinux OS Legacy, CloudLinux OS Shared Pro, and CloudLinux OS Solo, each tailored to improve server stability, security, and performance. With features such as kernel live patching, advanced automation and monitoring tools, and specialized WordPress optimization, CloudLinux helps hosting companies maximize security and profitability while ensuring stable server environments. Over 4,000 companies trust CloudLinux to power millions of websites worldwide, benefitting from increased stability and reduced churn rates. The company emphasizes compatibility with major hosting control panels and CentOS, offering solutions for shared hosts, agencies, and small businesses.

📋 Description

• Decide which files on a server deserve closer inspection within tight CPU and memory budgets • Detect malicious code from benign code at fleet scale while maintaining a sensible cost per file • Generate detection signatures automatically from new malware campaigns • Detect malware that appears malicious only in context, including phishing pages and script injections • Route each file to the appropriate detection engine • Make cleanup precise so sites remain clean afterward • Prove each model improves detection before production release • Own the path from raw samples to production models and demonstrate measurable impact • Build a first production-data model and evaluation harness during the first month • Have several models in production by month 3, including shadow-mode and live models gated on past-error regression sets • Establish a GPU-utilizing training setup and propose the detection cascade with cost-per-file and hardware requirements • Make models a main source of new detections by month 12 • Retrain on fresh analyst and false-negative labels on a fixed cadence • Integrate generated signatures into the analyst workflow • Enable other engineers to run two or three parallel training directions using the provided tooling • Work daily with malware analysts, detection and infrastructure engineers, and the ML team • Document decisions using ADR-Lite and follow ship gates preventing increases in false positives or false negatives • Conduct blameless post-mortems within 24 hours

🎯 Requirements

• 5+ years building ML systems that ran in production, including 2+ years in an adversarial domain: security, abuse, fraud, or spam • Experience training and fine-tuning transformer models, including data preparation, code tokenization, LoRA/QLoRA or full fine-tunes, distillation, and quantization • Classic ML expertise: gradient boosting, linear models on sparse features, calibration, class imbalance, and selecting when these outperform an LLM • Evaluation discipline: leakage-free splits by time and family, precision at a fixed false-positive budget, regression sets, and understanding differences between production and offline performance • Inference cost engineering: measuring throughput and latency and fitting models to CPU or memory budgets using ONNX, llama.cpp, vLLM, or int8/int4 • Strong Python, PyTorch, and Hugging Face stack skills • SQL proficiency on large analytical tables, such as ClickHouse or similar • Familiarity with PHP or JavaScript, or willingness to learn it while working with malware analysts • Daily use of AI coding agents, with ability to demonstrate how • English at upper-Intermediate (B2) level or higher, with particularly strong written communication for async work • Web malware, webshells, phishing kits, or WordPress security experience is a strong plus • Experience with AST or token features, code LLMs, graph models on program structure is a strong plus • Malware clustering and similarity analysis is a strong plus • Multi-GPU training on own bare metal, MLflow or Weights & Biases, and dataset versioning are strong pluses • Go or Rust for on-server inference is a strong plus • Published work or talks on ML for security are a strong plus

🏖️ Benefits

• A focus on professional development • Interesting and challenging projects • Fully remote work with flexible working hours, allowing you to schedule your day and work from any location worldwide • Paid 24 days of vacation per year • 10 days of national holidays • Unlimited sick leaves • Compensation for private medical insurance • Co-working reimbursement • Gym/sports reimbursement • Budget for education • Opportunity to receive a reward for the most innovative idea that the company can patent • Dedicated GPUs on the company's own bare metal for training directions • Leadership commitment to fund additional hardware when supported by data