ML engineer for malware detection

CloudLinux Inc.; United States; Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Remote-first

GPU доступ

Профессиональное развитие

Оплачиваемый отпуск 24 дня в год

Медицинское страхование

Job summary

CloudLinux Inc. ищет Senior ML Engineer для преобразования крупной базы данных веб-серверного вредоносного ПО в реальные детекторы и сигнатуры. Участвуют трансформеры, LLM-ассистированная тарига и автоматизация генерации сигнатур. Ваша задача — обеспечить низкий FP/FN и достойную инференцию на распределенной инфраструктуре.

Опыт работы с Python, PyTorch, Hugging Face обязателен. Условия удаленные, с гибким графиком; предусмотрены GPU-блоки, обучение и бюджет на исследования.

Qualifications

• 5+ лет опыта построения ML-систем в продакшене, 2+ года в зоне adversarial (security, abuse, fraud, spam)
• Умение обучать и дообучать трансформеры: data prep, токенизация кода, LoRA/QLoRA или полная настройка
• Классическое ML: градиентный бустинг, линейные модели на разреженных признаках, калибровка
• Оценка и контроль: leakage-free splits, метрики по FP‑budget, воспроизводимость
• Инференс и оптимизация: throughput/latency, ONNX, llama.cpp, vLLM, int8/int4
• Сильный Python, PyTorch, Hugging Face; SQL на больших таблицах (ClickHouse)
• Знание PHP или JavaScript или готовность учиться у аналитиков
• Уровень English не ниже B2; письменная коммуникация
• Будут плюсом: веб-майлинги, ML для кода, multi-GPU на bare metal, MLflow/W&B, версионирование датасетов, Go/Rust

Responsibilities

• Определять, какие файлы на сервере требуют closer look в рамках ограниченного CPU/памяти
• Разделять злонамеренный код от безобидного на масштабах флота
• Генерировать сигнатуры обнаружения из новых кампаний
• Улавливать malware, которое выглядит вредоносным в контексте (phishing, скрипты)
• Направлять каждый файл в нужный детектор
• Делать очистку точной, чтобы сайты оставались чистыми
• Доказывать улучшение моделей перед выпуском в продакшн
• Ответственность за путь от исходников до модели и метрики её эффективности

Skills

Production ML systems

Transformer models

Python

PyTorch

Hugging Face

SQL

Performance optimization

AI coding agents

English writing

Tools

ONNX

llama.cpp

vLLM

int8/int4

MLflow

Weights & Biases

Job description

Описание

We sit on one of the largest labeled corpora of live web-server malware in the industry: files, verdicts, cleanup outcomes, and analyst decisions collected from production hosting servers every day. It already drives our signatures, heuristics, and ML models, and there is far more to get out of it. We are looking for a Senior ML Engineer who will turn that data into detection that ships — classifiers, LLM-assisted triage and generated signatures — and keep exploring new ML/LLM methods against it, measured by the product's false-negative and false-positive rates, not by notebook accuracy.

Задачи

• Decide which files on a server deserve a closer look, within tight CPU and memory budgets
• Tell malicious code from benign at fleet scale and a sensible cost per file
• Generate detection signatures automatically from new campaigns
• Catch malware that only looks malicious in context, such as phishing pages and script injections
• Route each file to the right detection engine
• Make cleanup precise so sites stay clean afterwards
• Prove each model improves detection before it ships
• You own the path from raw samples to a model in production, and the numbers that prove it helped.

Требования

• 5+ years building ML systems that ran in production, including 2+ in an adversarial domain: security, abuse, fraud, or spam
• You have trained and fine-tuned transformer models yourself — data preparation, tokenizing code, LoRA/QLoRA or full fine-tunes, distillation, quantization — not only called hosted APIs
• Classic ML depth: gradient boosting, linear models on sparse features, calibration, class imbalance, and judgement on when these beat an LLM
• Evaluation discipline: leakage-free splits by time and family, precision at a fixed false-positive budget, regression sets, and an honest account of why production will differ from offline
• Inference cost engineering: you have measured throughput and latency and made a model fit a CPU or memory budget (ONNX, llama.cpp, vLLM, int8/int4)
• Strong Python, PyTorch and the Hugging Face stack; SQL on large analytical tables (ClickHouse or similar)
• Familiarity with PHP or JavaScript, or willingness to pick it up working with our malware analysts
• You use AI coding agents daily and can show how English at upper-Intermediate (B2) level or higher, with particularly strong written communication for async work
• Будет плюсом: Web malware, webshells, phishing kits or WordPress security experience; Models over code: AST or token features, code LLMs, graph models on program structure; Malware clustering and similarity analysis; Multi-GPU training on your own bare metal; MLflow or Weights & Biases; dataset versioning; Go or Rust, for on-server inference; Published work or talks on ML for security

Условия

• Remote-first, async across UTC−5 to UTC+8. You get an experimentation track, GPUs, and a direct line to leadership; in return, you bring numbers, not opinions.
• Each training direction starts with dedicated GPUs on our own bare metal; leadership has committed to fund more when the case is made with data
• Claude and Codex are the default tools, wired to GitLab, Jenkins, Redash, Jira, and Slite through MCP servers.
• You work daily with malware analysts, detection and infrastructure engineers, and the rest of our ML team
• A focus on professional development
• Interesting and challenging projects
• Fully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide
• Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves
• Compensation for private medical insurance
• Co-working and gym/sports reimbursement
• Budget for education
• The opportunity to receive a reward for the most innovative idea that the company can patent