Senior ML Engineer - Malware Detection (remote work)
CloudLinux2 days ago
Remote, Spain +11 moreSenior
Responsibilities
- Decide which server files require deeper inspection within CPU and memory budgets.
- Build models that distinguish malicious from benign code at fleet scale while managing cost per file.
- Automatically generate detection signatures from emerging malware campaigns.
- Detect contextual threats such as phishing pages and script injections.
- Route files to appropriate detection engines and improve cleanup precision.
- Train, evaluate, deploy, and retrain production models using time- and campaign-based leakage-free splits.
- Establish regression sets from historical false positives and false negatives and gate releases against them.
- Measure model throughput, latency, detection gains, false-positive rates, and false-negative trends.
- Develop tooling that enables multiple engineers to run parallel training directions.
- Work with malware analysts, detection engineers, infrastructure engineers, and the ML team.
Requirements
- 5+ years building ML systems that ran in production, including 2+ years in security, abuse, fraud, or spam.
- Hands-on experience training and fine-tuning transformer models, including data preparation, code tokenization, LoRA/QLoRA or full fine-tuning, distillation, and quantization.
- Strong classic ML knowledge covering gradient boosting, sparse linear models, calibration, class imbalance, and model selection versus LLM approaches.
- Experience with rigorous evaluation using leakage-free splits, fixed false-positive budgets, regression sets, and production-difference analysis.
- Experience optimizing inference throughput and latency for CPU or memory budgets.
- Strong Python, PyTorch, Hugging Face, and SQL skills for large analytical tables such as ClickHouse.
- Familiarity with PHP or JavaScript, or willingness to learn them.
- Daily use of AI coding agents and ability to demonstrate effective usage.
- English proficiency at upper-Intermediate (B2) level or higher with strong written communication.
- Web malware, webshell, phishing-kit, or WordPress security experience is a strong plus.
- Experience with code models, AST or token features, code LLMs, graph models, malware clustering, similarity analysis, multi-GPU training, MLflow, Weights & Biases, dataset versioning, Go, Rust, or published ML-for-security work is advantageous.
Benefits
- Fully remote work with flexible hours from any location worldwide.
- Remote-first asynchronous collaboration across UTC−5 to UTC+8.
- Professional development support and an education budget.
- Paid 24 days of vacation, 10 national holidays, and unlimited sick leave.
- Private medical insurance compensation.
- Co-working and gym or sports reimbursement.
- Opportunity to receive a reward for an innovative idea that the company can patent.
- Access to experimentation infrastructure including dedicated GPUs on company bare metal.
Categories
About CloudLinux
CloudLinux builds a commercially supported Linux operating system and server-hardening tools for hosting providers and data centers running multi-tenant environments. It sells subscriptions and support that improve server stability, resource isolation, and security for shared hosting workloads, along with related maintenance and patching services. Founded in 2009 and headquartered in Estero, Florida, the company is privately held.