Lead Security Engineer - Vulnerability Response (Imunify360)
CloudLinux16 hours ago
Remote, Spain +11 moreStaff+
Responsibilities
- Design and build the AI-driven vulnerability response pipeline from disclosure through public announcement.
- Extend the existing WordPress-plugin protection pipeline to ModSecurity and Coraza WAF rules.
- Write and review WAF rules using ModSecurity/SecLang for real-world web vulnerabilities.
- Build test harnesses to validate rules against exploits and real traffic before release.
- Lead and mentor security analysts, set priorities, review work, and remove blockers.
- Define and improve time-to-protection, critical-vulnerability coverage, and false-positive metrics.
- Automate advisory generation and coordinate its format and review process with marketing.
Requirements
- At least 5 years of experience in web or application security, vulnerability research, detection engineering, WAF engineering, or a similar area.
- Deep understanding of web attack classes including SQL injection, XSS, RCE, authentication bypass, path traversal, file upload, and deserialization, including detection in HTTP traffic.
- Hands-on experience writing WAF rules with ModSecurity/SecLang, OWASP CRS, or similar tools, plus regular expressions.
- Ability to read PHP code and understand vulnerabilities from advisories or patch diffs.
- Strong Python experience building production automation pipelines, with CI/CD and automated testing experience.
- Daily hands-on use of AI/LLM tools and the ability to verify their output.
- Proven experience leading a technical project end to end and applying a customer-focused product mindset.
- Upper-intermediate English or better.
- Preferred experience includes WordPress ecosystem security, Wordfence, Patchstack, WPScan, CVE credits or bug bounty work, Coraza or other WAF engines, exploit analysis, threat intelligence, Linux server administration, or the hosting industry.
Benefits
- Fully remote work with flexible working hours and the ability to work from anywhere worldwide.
- 24 paid vacation days per year, 10 national holidays, and unlimited sick leave.
- Professional development, challenging projects, and an education budget.
- Private medical insurance compensation.
- Co-working and gym/sports reimbursement.
- Opportunity to receive a reward for an innovative idea that the company can patent.
About CloudLinux
CloudLinux builds a commercially supported Linux operating system and server-hardening tools for hosting providers and data centers running multi-tenant environments. It sells subscriptions and support that improve server stability, resource isolation, and security for shared hosting workloads, along with related maintenance and patching services. Founded in 2009 and headquartered in Estero, Florida, the company is privately held.