Security Engineer Lead: AI-Driven Vulnerability Response

CloudLinux Inc.; Comunidad de Madrid; Remote; EUR 90,000 - 140,000; Full time

Benefits offered by this job

Paid vacation

Private medical insurance

Co-working reimbursement

Gym reimbursement

Education budget

Patent award potential

Remote-work flexibility

Job summary

CloudLinux is a global remote-first company hiring a Lead Security Engineer - Vulnerability Response to join our Web Protection Team. You will own the vulnerability response pipeline end to end, combining web security expertise with strong automation, and lead a small team of security analysts.

You will design an AI-driven pipeline, extend WordPress-plugin workflows to ModSecurity/Coraza, and write WAF rules for real-world vulnerabilities while building tests and coordinating with marketing for

Qualifications

• 5+ years in web/application security: vulnerability research, detection engineering, WAF engineering, or similar.
• Deep understanding of web attack classes (SQLi, XSS, RCE, auth bypass, path traversal, file upload, deserialization) and how to detect them in HTTP traffic.
• Hands-on experience writing WAF rules (ModSecurity/SecLang, OWASP CRS, or similar) and regular expressions.
• Able to read PHP code and understand a vulnerability from an advisory or a patch diff.
• Strong Python: you've built automation pipelines that run in production. CI/CD and automated testing.
• Hands-on daily use of AI/LLM tools; you know where to trust them and how to verify their output.
• Proven track record of leading a technical project end to end.
• Product mindset: you reason about customer impact, not only technical correctness.
• Upper-intermediate English or better.

Responsibilities

• Design and build the AI-driven vulnerability response pipeline from disclosure to announcement.
• Lead the extension of our existing WordPress-plugin pipeline to ModSecurity/Coraza rules.
• Write and review WAF rules for real-world web vulnerabilities.
• Build test harnesses that check rules against exploits and real traffic before release.
• Lead and mentor security analysts: set priorities, review their work, remove blockers.
• Define and track time-to-protection, coverage, and false-positive rate, and improve them.
• Automate advisory generation as part of the pipeline, and agree the format and review flow with marketing.

Skills

Web security

WAF engineering

Python automation

CI/CD pipelines

Threat intel

Product mindset

English communication

Tools

ModSecurity/SecLang

Coraza

OWASP CRS

Regex

PHP

Job description

CloudLinux is a global remote-first company hiring a Lead Security Engineer - Vulnerability Response to join our Web Protection Team. You will own the vulnerability response pipeline end to end, combining web security expertise with strong automation, and lead a small team of security analysts.

You will design an AI-driven pipeline, extend WordPress-plugin workflows to ModSecurity/Coraza, and write WAF rules for real-world vulnerabilities while building tests and coordinating with marketing for