[Hiring] Senior ML Engineer - Malware Detection @Cloudlinux

Role Description

We are looking for a Senior ML Engineer who will turn data into detection that ships — classifiers, LLM-assisted triage, and generated signatures — and keep exploring new ML/LLM methods against it, measured by the product's false-negative and false-positive rates, not by notebook accuracy.

What you'll work with:

• Malware samples from production servers, with verdicts and analyst decisions
• Years of signatures and detection rules
• Customer-reported false negatives and false positives
• Runtime behavior of code on live sites
• Web-attack traffic
• File metadata and how files spread across servers
• Cleanup outcomes, including what came back

What you will do:

• Achieve 10x more malware detected at the same or lower false-positive rate
• Decide which files on a server deserve a closer look, within tight CPU and memory budgets
• Differentiate malicious code from benign at fleet scale and a sensible cost per file
• Generate detection signatures automatically from new campaigns
• Catch malware that only looks malicious in context, such as phishing pages and script injections
• Route each file to the right detection engine
• Make cleanup precise so sites stay clean afterwards
• Prove each model improves detection before it ships

How we work:

• You get an experimentation track, GPUs, and a direct line to leadership; in return, you bring numbers, not opinions.
• Remote-first, async across UTC−5 to UTC+8. Decisions are written down (ADR-Lite) and public by default.
• Hardware follows evidence: Each training direction starts with dedicated GPUs on our own bare metal; leadership has committed to fund more when the case is made with data.
• Agentic engineering: Claude and Codex are the default tools, wired to GitLab, Jenkins, Redash, Jira, and Slite through MCP servers.
• Close to ground truth: You work daily with malware analysts, detection and infrastructure engineers, and the rest of our ML team.
• Ship gates: No model or build goes out if it raises false positives or false negatives on our past-error sets. Blameless post-mortems within 24 hours.

What you'll deliver:

• Own the path from raw samples to a model in production, and the numbers that prove it helped.
• First month: A first model trained on production data and measured against today's engines — suspicious-file triage or a metadata model.
• By month 3: Several models in production: some in shadow mode building evidence, some live and producing real detections, all gated on the past-error regression set.
• By month 12: Models are a main source of new detections, reported as share of new detections and FN-rate trend.

Qualifications

• 5+ years building ML systems that ran in production, including 2+ in an adversarial domain: security, abuse, fraud, or spam.
• Experience training and fine-tuning transformer models — data preparation, tokenizing code, LoRA/QLoRA or full fine-tunes, distillation, quantization.
• Classic ML depth: gradient boosting, linear models on sparse features, calibration, class imbalance.
• Evaluation discipline: leakage-free splits by time and family, precision at a fixed false-positive budget.
• Inference cost engineering: measured throughput and latency, fitting a model to a CPU or memory budget.
• Strong Python, PyTorch, and the Hugging Face stack; SQL on large analytical tables (ClickHouse or similar).
• Familiarity with PHP or JavaScript, or willingness to pick it up working with our malware analysts.
• Upper-Intermediate (B2) level or higher English, with strong written communication for async work.

Requirements

• Web malware, webshells, phishing kits or WordPress security experience is a strong plus.
• Experience with models over code: AST or token features, code LLMs, graph models on program structure.
• Malware clustering and similarity analysis.
• Multi-GPU training on your own bare metal; MLflow or Weights & Biases; dataset versioning.
• Experience with Go or Rust for on-server inference.
• Published work or talks on ML for security.

Benefits

• A focus on professional development.
• Interesting and challenging projects.
• Fully remote work with flexible working hours.
• Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves.
• Compensation for private medical insurance.
• Co-working and gym/sports reimbursement.
• Budget for education.
• Opportunity to receive a reward for the most innovative idea that the company can patent.