ML engineer in malware detection

CloudLinux Inc.; United States; Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

До 24 дней отпуска в год

10 национальных праздников

Неограниченный больничный

Мmedizinская страховка

Коворкинг и возмещение расходов на gym

Бюджет на образование

Бонус за патент/идею

Job summary

CloudLinux Inc. ищет опытного ML-инженера для разработки и внедрения моделей в области кибербезопасности.

Ваша роль — руководить конвейером от сырьевых данных к продакшен-модели, обеспечивая соответствие бюджету ресурсов и высоким показателям точности защиты веб-сайтов и инфраструктуры. Требуется 5+ лет опыта в производственных ML-системах, владение PyTorch, Hugging Face и SQL, и умение работать в удалённой, международной среде.

Qualifications

• 5+ лет разработки ML-систем в продакшене, в том числе 2+ года в зонах угроз/босп/мошенничество.
• Вы обучали и дообучали трансформеры: LoRA/QLoRA, полные fine-tune, distillation, quantization.
• Стратегии оценки: leakage-free splits, точность при заданном пороге FP, наборы регрессии.
• Инференс: измерение throughput/latency, подбор модели под CPU/memory budget (ONNX, llama.cpp, vLLM).
• Сильный Python, PyTorch и Hugging Face; SQL на больших аналитических таблицах.

Responsibilities

• Выберите файлы на сервере для детектирования в рамках бюджета CPU и памяти.
• Определяйте вредоносный код противомонахом на массиве fleet-уровня.
• Генерируйте сигнатуры детекции автоматически из новых кампаний.
• Перекладывайте каждый файл к нужному детектору и обеспечьте точную чистку.
• Управляйте путём от сырьевых образцов к продакшен-модели и метрикам эффективности.

Skills

Python

PyTorch

Hugging Face

SQL

MLOps

English B2+

Tools

ONNX

llama.cpp

vLLM

MLflow

Weights & Biases

Job description

Описание:

CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful.

Задачи:

Decide which files on a server deserve a closer look, within tight CPU and memory budgets Tell malicious code from benign at fleet scale and a sensible cost per file Generate detection signatures automatically from new campaigns Catch malware that only looks malicious in context, such as phishing pages and script injections Route each file to the right detection engine Make cleanup precise so sites stay clean afterwards Prove each model improves detection before it ships You own the path from raw samples to a model in production, and the numbers that prove it helped.

Требования:

5+ years building ML systems that ran in production, including 2+ in an adversarial domain: security, abuse, fraud, or spam You have trained and fine-tuned transformer models yourself — data preparation, tokenizing code, LoRA/QLoRA or full fine-tunes, distillation, quantization — not only called hosted APIs Classic ML depth: gradient boosting, linear models on sparse features, calibration, class imbalance, and judgement on when these beat an LLM Evaluation discipline: leakage-free splits by time and family, precision at a fixed false-positive budget, regression sets, and an honest account of why production will differ from offline Inference cost engineering: you have measured throughput and latency and made a model fit a CPU or memory budget (ONNX, llama.cpp, vLLM, int8/int4) Strong Python, PyTorch and the Hugging Face stack; SQL on large analytical tables (ClickHouse or similar) Familiarity with PHP or JavaScript, or willingness to pick it up working with our malware analysts You use AI coding agents daily and can show how English at upper-Intermediate (B2) level or higher, with particularly strong written communication for async work Будет плюсом: Web malware, webshells, phishing kits or WordPress security experience; Models over code: AST or token features, code LLMs, graph models on program structure; Malware clustering and similarity analysis; Multi-GPU training on your own bare metal; MLflow or Weights & Biases; dataset versioning; Go or Rust, for on-server inference; Published work or talks on ML for security

Условия:

You get an experimentation track, GPUs, and a direct line to leadership; in return, you bring numbers, not opinions. Remote-first, async across UTC−5 to UTC+8. Decisions are written down (ADR-Lite) and public by default Hardware follows evidence: Each training direction starts with dedicated GPUs on our own bare metal; leadership has committed to fund more when the case is made with data Agentic engineering: Claude and Codex are the default tools, wired to GitLab, Jenkins, Redash, Jira, and Slite through MCP servers. We look at how engineers work with agents — context, specificity, review quality — not only at output Close to ground truth: You work daily with malware analysts, detection and infrastructure engineers, and the rest of our ML team Ship gates: No model or build goes out if it raises false positives or false negatives on our past-error sets. Blameless post-mortems within 24 hours A focus on professional development Interesting and challenging projects Fully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves Compensation for private medical insurance Co-working and gym/sports reimbursement Budget for education The opportunity to receive a reward for the most innovative idea that the company can patent