What you will do

:

The goal is 10x more malware detected at the same or lower false-positive rate. Hand-written rules and faster pipelines will not get there; models trained on our data might.

Decide which files on a server deserve a closer look, within tight CPU and memory budgets Tell malicious code from benign at fleet scale and a sensible cost per file Generate detection signatures automatically from new campaigns Catch malware that only looks malicious in context, such as phishing pages and script injections Route each file to the right detection engine Make cleanup precise so sites stay clean afterwards Prove each model improves detection before it ships

How we work:

You get an experimentation track, GPUs, and a direct line to leadership; in return, you bring numbers, not opinions.

Remote-first, async across UTC−5 to UTC+8. Decisions are written down (ADR-Lite) and public by default. Hardware follows evidence: Each training direction starts with dedicated GPUs on our own bare metal; leadership has committed to fund more when the case is made with data. Agentic engineering: Claude and Codex are the default tools, wired to GitLab, Jenkins, Redash, Jira, and Slite through MCP servers. We look at how engineers work with agents — context, specificity, review quality — not only at output. Close to ground truth: You work daily with malware analysts, detection and infrastructure engineers, and the rest of our ML team. Ship gates: No model or build goes out if it raises false positives or false negatives on our past-error sets. Blameless post-mortems within 24 hours.

What you'll deliver:





You own the path from raw samples to a model in production, and the numbers that prove it helped.

First month: A first model trained on production data and measured against today's engines — suspicious-file triage or a metadata model. The evaluation harness in place: splits by time and campaign so families don't leak, and a regression set from past FPs and FNs. By month 3: Several models in production: some in shadow mode building evidence, some live and producing real detections, all gated on the past-error regression set. A training setup that keeps its GPUs busy. A written proposal (ADR) for the detection cascade, with cost per file and hardware needs. By month 12: Models are a main source of new detections, reported as share of new detections and FN-rate trend. Retraining on fresh analyst and FN labels on a fixed cadence. Generated signatures inside the analyst workflow. Two or three parallel training directions that other engineers can run with your tooling.

Requirements

What you bring:

5+ years building ML systems that ran in production, including 2+ in an adversarial domain: security, abuse, fraud, or spam. You have trained and fine-tuned transformer models yourself — data preparation, tokenizing code, LoRA/QLoRA or full fine-tunes, distillation, quantization — not only called hosted APIs. Classic ML depth: gradient boosting, linear models on sparse features, calibration, class imbalance, and judgement on when these beat an LLM. Evaluation discipline: leakage-free splits by time and family, precision at a fixed false-positive budget, regression sets, and an honest

📌 Senior ML Engineer (Madrid)
🏢 CloudLinux
📍 Madrid