Staff Security Engineer, Imunify360 (remote work)

Cloudlinux; Lisboa; Remote; EUR 120,000 - 180,000; Full time

Job summary

CloudLinux Inc. is a global remote-first company building Imunify360, a security suite for Linux servers.

We seek a Staff Security Engineer to own end-to-end threat discovery, detection, mitigation and post-incident review in a hands-on leadership capacity. You will analyze malware, design detections, and collaborate with engineering, security research, and support teams to deliver production-ready protections at scale.

Qualifications

• Experience in security research and engineering for Linux servers and web apps.
• Hands-on technical leadership with ability to mentor others.
• Ability to own security incidents, severity models, runbooks, and disclosures.

Responsibilities

• Lead malware and campaign mitigation across the product's protection layers.
• Coordinate security response with vendors, CERTs/CSIRTs, and partners.
• Red-team and threat-model features before shipping and turn findings into fixes.
• Develop detections and tooling, with 30–50% hands-on build time.
• Turn telemetry into intelligence for internal briefs.

Skills

Malware analysis

Threat modeling

Reverse engineering

Incident response

Security automation

Tools

Python

Go

Job description

CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful.

Check out our website for more information: cloudlinux.com

We are currently hiring a Staff Security Engineer within the Imunify360 product.

Imunify360 is CloudLinux's security suite for Linux web servers. It protects hundreds of thousands of hosting servers and the websites running on them, so it sees most large-scale web attacks early — often in the first hours.

Check out our website for more information: https://imunify360.com/

Role Mission & Scope

At Imunify360, protecting customers from evolving cyber threats requires close collaboration between security research, engineering, and other teams. Responding to complex attack campaigns involves more than identifying threats — it requires understanding attack techniques, developing effective detection and mitigation strategies, and ensuring customers are protected.

As a Staff Security Engineer, you'll take end-to-end technical ownership of complex security challenges, from initial threat discovery and analysis to detection, mitigation, and post-incident review.

This is a hands-on technical leadership role focused on practical security engineering rather than SOC monitoring, compliance, or purely theoretical research. You'll analyze malware and exploit code, develop detection and mitigation tools, anticipate emerging attack techniques, and ensure security findings translate into production-ready detections, mitigations, and fixes.

You'll work closely with engineering, security research, support, external partners, and the broader security community to coordinate responses and drive continuous improvements in our security capabilities.

As an individual contributor, you won't have direct reports or people management responsibilities. All security research and testing are conducted within authorized boundaries, with clearly defined scope and responsible disclosure practices.

Your mission is to strengthen Imunify360's ability to detect, prevent, and respond to emerging threats, delivering measurable security improvements that protect customers at scale.

What you will own

Malware and campaign mitigation

• Lead response to large-scale exploitation and malware campaigns: triage, root cause, and mitigation across every protection layer of the product.
• Reverse-engineer malware and exploits targeting Linux servers and web applications.
• Track campaigns over time, not just individual samples: cluster indicators, connect activity to known actors and toolkits, anticipate the next variant.
• Define and run measurable outcomes per campaign: time to detect, time to protect, cleanup effectiveness, reinfection rate.

Security response coordination

• Own the security incident and response process, both for threats against our customers and for vulnerabilities in our own product: severity model, runbooks, communication, escalation.
• Coordinate with external parties — software vendors, partners, CERTs/CSIRTs, abuse desks, other security vendors. Drive responsible disclosure where we find vulnerabilities.
• Be the technical voice in security advisories and partner briefings, together with Product and Support.
• Triage external vulnerability reports.

Offensive security on our own product

• Red-team our product and infrastructure. Assume a capable attacker who already has a foothold.
• Threat-model new features before they ship; own the security review gate for high-risk changes.
• Turn findings into fixes with the owning teams, not just reports.

Detection engineering and tooling

• Raise the quality bar of detections: false-positive budgets, test corpora, staged rollout with measurement gates and fast rollback.
• Build and automate the analysis pipeline: dynamic analysis, honeypots, telemetry-driven hunting, ML-assisted triage where it measurably helps.
• Write production code for these tools; expect 30–50% of your time to be hands‑on building.
• Turn telemetry into intelligence: emerging exploits, attacker infrastructure, trends — shared as internal briefs and selected public research.

People multiplier (no direct reports)

• Mentor analysts and engineers; raise the security skill level across teams.
• Bar-raiser in security hiring loops.

Key Milestones

• 30 days: Analyzed real threats end-to-end. Mapped the current response flow and where it breaks. Shipped at least one detection or mitigation to production.
• 90 days: Security response process and severity model published and agreed. Led at least one real campaign response with a written post-mortem. Baseline response metrics in place.