Lead Security Engineer – AI-Driven Vulnerability Response (Remote)

CloudLinux Inc.; Polska; Remote; PLN 200,000 - 360,000; Full time

Benefits offered by this job

Fully remote work with flexible hours

Paid 24 days of vacation per year

10 national holidays per year

Unlimited sick leaves

Private medical insurance

Job summary

CloudLinux Inc. is seeking a Lead Security Engineer - Vulnerability Response to own the vulnerability response pipeline end to end.

You will combine deep web application security expertise with automation, guiding a small team of security analysts and collaborating with automation, QA, and marketing. You will design an AI-assisted process to intake disclosures, triage, draft rules, test, and publish advisories while extending the WordPress-plugin workflow to ModSecurity/Coraza rules, ensuring

Qualifications

• 5+ years in web/application security.
• Deep understanding of web attack classes (SQLi, XSS, RCE, auth bypass, path traversal, file upload, deserialization) and how to detect them in HTTP traffic.
• Hands-on experience writing WAF rules (ModSecurity/SecLang, OWASP CRS, or similar) and regular expressions.
• Able to read PHP code and understand a vulnerability from an advisory or a patch diff.
• Strong Python: you've built automation pipelines that run in production.
• CI/CD and automated testing.
• Hands-on daily use of AI/LLM tools; you know where to trust them and how to verify their output.
• Proven track record of leading a technical project end to end.
• Product mindset: you reason about customer impact, not only technical correctness.
• Upper-intermediate English or better.
• Nice to have: WordPress ecosystem security: plugin vulnerabilities, vulnerability feeds (Wordfence, Patchstack, WPScan), CVE credits or bug bounty.
• Nice to have: Coraza or other WAF engines.
• Nice to have: Exploit analysis or threat intelligence background.
• Nice to have: Linux server administration, hosting industry.
• Personal skills: Strong ownership; communicate clearly; calm under pressure; make decisions with incomplete information.

Responsibilities

• Design and build the AI-driven pipeline from disclosure to announcement: vulnerability intake, triage, rule drafting, testing, release, and the public advisory.
• Lead the extension of our existing WordPress-plugin pipeline to ModSecurity/Coraza rules.
• Write and review WAF rules (ModSecurity/SecLang) for real-world web vulnerabilities.
• Build test harnesses that check rules against exploits and real traffic before release.
• Lead and mentor security analysts: set priorities, review their work, remove blockers.
• Define and track time-to-protection, coverage, and false-positive rate, and improve them.
• Automate advisory generation as part of the pipeline, and agree the format and review flow with marketing.

Job description

CloudLinux Inc. is seeking a Lead Security Engineer - Vulnerability Response to own the vulnerability response pipeline end to end.

You will combine deep web application security expertise with automation, guiding a small team of security analysts and collaborating with automation, QA, and marketing. You will design an AI-assisted process to intake disclosures, triage, draft rules, test, and publish advisories while extending the WordPress-plugin workflow to ModSecurity/Coraza rules, ensuring