Staff Security Engineer, Imunify360 (remote work)

📋 Job Overview

CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful. Check out our website for more information: cloudlinux.com

🏢 About CloudLinux

We are currently hiring a Staff Security Engineer within the Imunify360 product. Imunify360 is CloudLinux's security suite for Linux web servers. It protects hundreds of thousands of hosting servers and the websites running on them, so it sees most large-scale web attacks early — often in the first hours. Check out our website for more information: https://imunify360.com/

🎯 The Role

At Imunify360, protecting customers from evolving cyber threats requires close collaboration between security research, engineering, and other teams. Responding to complex attack campaigns involves more than identifying threats — it requires understanding attack techniques, developing effective detection and mitigation strategies, and ensuring customers are protected. As a Staff Security Engineer, you'll take end-to-end technical ownership of complex security challenges, from initial threat discovery and analysis to detection, mitigation, and post-incident review.

✅ Key Responsibilities

• Lead response to large-scale exploitation and malware campaigns: triage, root cause, and mitigation across every protection layer of the product.
• Reverse-engineer malware and exploits targeting Linux servers and web applications.
• Track campaigns over time, not just individual samples: cluster indicators, connect activity to known actors and toolkits, anticipate the next variant.
• Define and run measurable outcomes per campaign: time to detect, time to protect, cleanup effectiveness, reinfection rate.
• Own the security incident and response process, both for threats against our customers and for vulnerabilities in our own product: severity model, runbooks, communication, escalation.
• Coordinate with external parties — software vendors, partners, CERTs/CSIRTs, abuse desks, other security vendors. Drive responsible disclosure where we find vulnerabilities.
• Be the technical voice in security advisories and partner briefings, together with Product and Support.
• Triage external vulnerability reports.
• Red-team our product and infrastructure. Assume a capable attacker who already has a foothold.
• Threat-model new features before they ship; own the security review gate for high-risk changes.
• Turn findings into fixes with the owning teams, not just reports.
• Raise the quality bar of detections: false-positive budgets, test corpora, staged rollout with measurement gates and fast rollback.
• Build and automate the analysis pipeline: dynamic analysis, honeypots, telemetry-driven hunting, ML-assisted triage where it measurably helps.
• Write production code for these tools; expect 30–50% of your time to be hands-on building.
• Turn telemetry into intelligence: emerging exploits, attacker infrastructure, trends — shared as internal briefs and selected public research.
• Mentor analysts and engineers; raise the security skill level across teams.
• Bar-raiser in security hiring loops.

📌 Required Qualifications

• 10+ years in security engineering, malware research, incident response, or offensive security, with several years leading cross-team work at Staff/Principal/Lead scope.
• Deep hands-on malware analysis and reverse engineering skills.
• Strong web application security and practical exploitation experience.
• Deep Linux knowledge from both the attacker's and the defender's side.
• Proven incident response leadership on large-scale events: you have run the response, written the advisory, and closed the post-mortem.
• Production coding in at least one language (C/C++, Python, Go, Rust, Java, or similar).
• Experience with security automation and tooling development.
• Excellent communication skills and ability to collaborate across teams.
• Strong problem-solving and analytical thinking abilities.

⭐ Desirable Experience

• Experience with security products for web servers or hosting environments.
• Knowledge of cloud security principles and technologies.
• Experience with threat intelligence platforms and techniques.
• Understanding of DevSecOps practices and tools.
• Public speaking or technical presentation experience.

🎁 Benefits

Competitive salary and benefits package. CloudLinux is a remote-first company, offering flexible work arrangements and a supportive team environment.

🛂 Visa & Eligibility

CloudLinux is an equal opportunity employer and welcomes applicants from all backgrounds. We are committed to providing equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status.