Staff Security Engineer, Imunify360

🔥 26 minutes ago

🌐 Portugal, Poland, +2 more countries – Remote

🇵🇹 Portugal – Remote 🇵🇱 Poland – Remote 🇪🇸 Spain – Remote 🇨🇿 Czechia – Remote

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 10%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

CloudLinux

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2009

☁️ SaaS

🔐 Security

🌐 Web 3

SaaS • Security • Web 3

CloudLinux is a leading provider of operating systems designed specifically for web hosting environments. The company offers a line of products including CloudLinux OS Legacy, CloudLinux OS Shared Pro, and CloudLinux OS Solo, each tailored to improve server stability, security, and performance. With features such as kernel live patching, advanced automation and monitoring tools, and specialized WordPress optimization, CloudLinux helps hosting companies maximize security and profitability while ensuring stable server environments. Over 4,000 companies trust CloudLinux to power millions of websites worldwide, benefitting from increased stability and reduced churn rates. The company emphasizes compatibility with major hosting control panels and CentOS, offering solutions for shared hosts, agencies, and small businesses.

📋 Description

• Lead response to large-scale exploitation and malware campaigns, including triage, root cause analysis, and mitigation across every protection layer. • Reverse-engineer malware and exploits targeting Linux servers and web applications. • Track campaigns over time by clustering indicators, connecting activity to known actors and toolkits, and anticipating variants. • Define and run measurable campaign outcomes, including time to detect, time to protect, cleanup effectiveness, and reinfection rate. • Own the security incident and response process for customer threats and product vulnerabilities, including severity models, runbooks, communications, and escalation. • Coordinate with software vendors, partners, CERTs/CSIRTs, abuse desks, and security vendors; drive responsible disclosure. • Act as the technical voice in security advisories and partner briefings with Product and Support. • Triage external vulnerability reports. • Red-team the product and infrastructure and threat-model new features before release. • Own the security review gate for high-risk changes and turn findings into fixes. • Improve detection quality through false-positive budgets, test corpora, staged rollouts, measurement gates, and rollback. • Build and automate analysis pipelines using dynamic analysis, honeypots, telemetry-driven hunting, and ML-assisted triage where useful. • Write production code for security tools, spending approximately 30–50% of time hands-on building. • Turn telemetry into intelligence and share internal briefs and selected public research. • Mentor analysts and engineers and serve as a bar-raiser in security hiring loops. • Deliver key milestones at 30 days, 90 days, 6 months, and 12 months, including production detections, response processes, campaign post-mortems, red-team reviews, fixes, metrics, and public research or disclosures.

🎯 Requirements

• 10+ years in security engineering, malware research, incident response, or offensive security, with several years leading cross-team work at Staff/Principal/Lead scope. • Deep hands-on malware analysis and reverse engineering skills. • Strong web application security and practical exploitation experience. • Deep Linux knowledge from both the attacker's and the defender's side. • Proven incident response leadership on large-scale events: you have run the response, written the advisory, and closed the post-mortem. • Production coding in Python plus a systems language (Go, Rust or C). • Experience with coordinated vulnerability disclosure and working with the security community. • Clear, short writing for both engineers and non-technical stakeholders; works well async across time zones. • Daily user of AI tools for analysis and coding, with critical judgment about their output. • Background in hosting or large web ecosystems is nice to have. • Detection authoring at scale (signatures, WAF/IDS rules) is nice to have. • Kernel-level monitoring and rootkit detection is nice to have. • Threat intelligence practice and actor tracking is nice to have. • ML for malware classification is nice to have. • Public track record: CVEs, published research, talks, CTFs, open-source security tools is nice to have. • Relevant certifications are a plus, not a requirement.

🏖️ Benefits

• Stay hands-on technically while owning complex, high-impact engineering work. • Work on challenging Linux, automation, and cybersecurity problems across mature and newer products. • Influence technical direction and make meaningful architectural decisions. • Work independently with a high level of ownership and autonomy. • Fully remote work with flexible working hours. • 24 paid vacation days, 10 national holidays, and unlimited sick leave. • Private medical insurance compensation. • Co-working and gym/sports reimbursement. • Education budget. • Opportunity to receive a reward for innovative ideas that the company can patent.