{"id":3171638,"url":"https://alion.io/job/cloudlinux-senior-ml-engineer-malware-detection-remote-work","title":"Senior ML Engineer - Malware Detection (remote work)","company":{"id":3432,"name":"CloudLinux","domain":"cloudlinux.com","url":"https://alion.io/company/cloudlinux","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"AI/ML","role_family":"AI/ML","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":{"label":"UTC-5 – UTC+8","utc_offset_min":-5,"utc_offset_max":8},"hiring_geo_confidence":"inferred","locations":["Warsaw, Poland","Madrid, Spain","Tbilisi, Georgia","Sofia, Bulgaria","Yerevan, Armenia","Podgorica, Montenegro"],"countries":["PL","ES","GE","BG","AM","ME"],"hiring_countries":["BG","PL","ES","AM","GE"],"hiring_countries_total":5,"salary":null,"salary_estimate":{"min_usd":61000,"max_usd":107000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":44},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Claude","optional":false},{"name":"ClickHouse","optional":false},{"name":"GitLab","optional":false},{"name":"Hugging Face","optional":false},{"name":"JavaScript","optional":false},{"name":"Jenkins","optional":false},{"name":"Jira","optional":false},{"name":"Knowledge Distillation","optional":false},{"name":"Linux","optional":false},{"name":"llama.cpp","optional":false},{"name":"LLM","optional":false},{"name":"LLM Evaluation","optional":false},{"name":"LoRA","optional":false},{"name":"MLFlow","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Model Distillation","optional":false},{"name":"ONNX","optional":false},{"name":"OpenAI Codex","optional":false},{"name":"PHP","optional":false},{"name":"Python","optional":false},{"name":"PyTorch","optional":false},{"name":"QLoRA","optional":false},{"name":"Quantization","optional":false},{"name":"Rust","optional":false},{"name":"SQL","optional":false},{"name":"vLLM","optional":false},{"name":"Weights & Biases","optional":false},{"name":"WordPress","optional":false},{"name":"PEFT","optional":true}],"status":"live","first_seen_at":"2026-10-23T18:45:19Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-25T20:35:36Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful.\nCheck out our website for more information: https://cloudlinux.com/\nImunify360 is CloudLinux's security suite for Linux web servers: real-time and background malware scanning, automated cleanup, a WAF, runtime PHP protection (Proactive Defense), a database malware scanner, and IP reputation. It runs on hosting providers' shared, VPS, and dedicated servers, so new web-malware campaigns land on our fleet early.\nWe sit on one of the largest labeled corpora of live web-server malware in the industry: files, verdicts, cleanup outcomes, and analyst decisions collected from production hosting servers every day. It already drives our signatures, heuristics, and ML models, and there is far more to get out of it. We are looking for a Senior ML Engineer who will turn that data into detection that ships - classifiers, LLM-assisted triage and generated signatures - and keep exploring new ML/LLM methods against it, measured by the product's false-negative and false-positive rates, not by notebook accuracy.\nOur dataset focuses on web malware - PHP, JavaScript, HTML phishing kits, infected WordPress and Joomla plugins and themes, database injections - with the context around each file.\nWhat you'll work with:\nMalware samples from production servers, with verdicts and analyst decisions\nYears of signatures and detection rules\nCustomer-reported false negatives and false positives\nRuntime behavior of code on live sites\nWeb-attack traffic\nFile metadata and how files spread across servers\nCleanup outcomes, including what came back\nWhat you will do:\nThe goal is 10x more malware detected at the same or lower false-positive rate. Hand-written rules and faster pipelines will not get there; models trained on our data might.\nDecide which files on a server deserve a closer look, within tight CPU and memory budgets\nTell malicious code from benign at fleet scale and a sensible cost per file\nGenerate detection signatures automatically from new campaigns\nCatch malware that only looks malicious in context, such as phishing pages and script injections\nRoute each file to the right detection engine\nMake cleanup precise so sites stay clean afterwards\nProve each model improves detection before it ships\nHow we work:\nYou get an experimentation track, GPUs, and a direct line to leadership; in return, you bring numbers, not opinions.\n Remote-first, async across UTC-5 to UTC+8. Decisions are written down (ADR-Lite) and public by default.\nHardware follows evidence: Each training direction starts with dedicated GPUs on our own bare metal; leadership has committed to fund more when the case is made with data.\nAgentic engineering: Claude and Codex are the default tools, wired to GitLab, Jenkins, Redash, Jira, and Slite through MCP servers. We look at how engineers work with agents - context, specificity, review quality - not only at output.\nClose to ground truth: You work daily with malware analysts, detection and infrastructure engineers, and the rest of our ML team.\nShip gates: No model or build goes out if it raises false positives or false negatives on our past-error sets. Blameless post-mortems within 24 hours.\nWhat you'll deliver:\nYou own the path from raw samples to a model in production, and the numbers that prove it helped.\nFirst month: A first model trained on production data and measured against today's engines - suspicious-file triage or a metadata model. The evaluation harness in place: splits by time and campaign so families don't leak, and a regression set from past FPs and FNs.\n By month 3: Several models in production: some in shadow mode building evidence, some live and producing real detections, all gated on the past-error regression set. A training setup that keeps its GPUs busy. A written proposal (ADR) for the detection cascade, with cost per file and hardware needs.\nBy month 12: Models are a main source of new detections, reported as share of new detections and FN-rate trend. Retraining on fresh analyst and FN labels on a fixed cadence. Generated signatures inside the analyst workflow. Two or three parallel training directions that other engineers can run with your tooling.\nRequirements\nWhat you bring:\n5+ years building ML systems that ran in production, including 2+ in an adversarial domain: security, abuse, fraud, or spam.\nYou have trained and fine-tuned transformer models yourself - data preparation, tokenizing code, LoRA/QLoRA or full fine-tunes, distillation, quantization - not only called hosted APIs.\nClassic ML depth: gradient boosting, linear models on sparse features, calibration, class imbalance, and judgement on when these beat an LLM.\nEvaluation discipline: leakage-free splits by time and family, precision at a fixed false-positive budget, regression sets, and an honest account of why production will differ from offline.\n Inference cost engineering: you have measured throughput and latency and made a model fit a CPU or memory budget (ONNX, llama.cpp, vLLM, int8/int4).\n Strong Python, PyTorch and the Hugging Face stack; SQL on large analytical tables (ClickHouse or similar).\nFamiliarity with PHP or JavaScript, or willingness to pick it up working with our malware analysts.\nYou use AI coding agents daily and can show how.\n English at upper-Intermediate (B2) level or higher, with particularly strong written communication for async work.\nIt is a strong plus if you have:\nWeb malware, webshells, phishing kits or WordPress security experience.\nModels over code: AST or token features, code LLMs, graph models on program structure.\nMalware clustering and similarity analysis.\nMulti-GPU training on your own bare metal; MLflow or Weights & Biases; dataset versioning.\nGo or Rust, for on-server inference.\nPublished work or talks on ML for security.\nBenefits\nWhat's in it for you?\nA focus on professional development.\nInteresting and challenging projects.\nFully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide.\nPaid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves.\nCompensation for private medical insurance.\nCo-working and gym/sports reimbursement.\nBudget for education.\nThe opportunity to receive a reward for the most innovative idea that the company can patent.\nBy applying for this position, you consent to the processing of your personal data as described in our Privacy Policy (https://cloudlinux.com/candidate-privacy-notice), which provides detailed information on how we maintain and handle your data.","description_format":"text","description_chars":6877,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":["Flexible schedule","Health insurance","Professional development"],"hiring_locations":[{"name":"Bulgaria","iso":"BG","kind":"country"},{"name":"Poland","iso":"PL","kind":"country"},{"name":"Spain","iso":"ES","kind":"country"},{"name":"Armenia","iso":"AM","kind":"country"},{"name":"Georgia","iso":"GE","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Operating Systems","Vulnerability Management","Web Security & DDoS Protection"],"lifecycle":[{"event":"open","at":"2026-10-23T18:45:19Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":21,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-25T05:49:26Z"},"pay":null,"html_url":"https://alion.io/job/cloudlinux-senior-ml-engineer-malware-detection-remote-work","json_url":"https://alion.io/job/cloudlinux-senior-ml-engineer-malware-detection-remote-work.json","meta":{"generated_at":"2026-10-25T22:39:36Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":31989,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3432},"rest":"https://alion.io/mcp/rest/get_company?id=3432"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcloudlinux-senior-ml-engineer-malware-detection-remote-work"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcloudlinux-senior-ml-engineer-malware-detection-remote-work"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcloudlinux-senior-ml-engineer-malware-detection-remote-work"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cloudlinux-senior-ml-engineer-malware-detection-remote-work\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcloudlinux-senior-ml-engineer-malware-detection-remote-work"}]}