What you will do

:

The goal is 10x more malware detected at the same or lower false-positive rate. Hand-written rules and faster pipelines will not get there;
models trained on our data might.

- Decide which files on a server deserve a closer look, within tight CPU and memory budgets
- Tell malicious code from benign at fleet scale and a sensible cost per file
- Generate detection signatures automatically from new campaigns
- Catch malware that only looks malicious in context, such as phishing pages and script injections
- Route each file to the right detection engine
- Make cleanup precise so sites stay clean afterwards
- Prove each model improves detection before it ships

How we work:

You get an experimentation track, GPUs, and a direct line to leadership;
in return, you bring numbers, not opinions.

- Remote-first, async across UTC−5 to UTC+8. Decisions are written down (ADR-Lite) and public by default.
- Hardware follows evidence: Each training direction starts with dedicated GPUs on our own bare metal;
leadership has committed to fund more when the case is made with data.
- Agentic engineering: Claude and Codex are the default tools, wired to GitLab, Jenkins, Redash, Jira, and Slite through MCP servers. We look at how engineers work with agents — context, specificity, review quality — not only at output.
- Close to ground truth: You work daily with malware analysts, detection and infrastructure engineers, and the rest of our ML team.
- Ship gates: No model or build goes out if it raises false positives or false negatives on our past-error sets. Blameless post-mortems within 24 hours.

What you'll deliver:





You own the path from raw samples to a model in production, and the numbers that prove it helped.

- First month: A first model trained on production data and measured against today's engines — suspicious-file triage or a metadata model. The evaluation harness in place: splits by time and campaign so families don't leak, and a regression set from past FPs and FNs.
- By month 3: Several models in production: some in shadow mode building evidence, some live and producing real detections, all gated on the past-error regression set. A training setup that keeps its GPUs busy. A written proposal (ADR) for the detection cascade, with cost per file and hardware needs.
- By month 12: Models are a main source of new detections, reported as share of new detections and FN-rate trend. Retraining on fresh analyst and FN labels on a fixed cadence. Generated signatures inside the analyst workflow. Two or three parallel training directions that other engineers can run with your tooling.

Requirements

What you bring:

- 5+ years building ML systems that ran in production, including 2+ in an adversarial domain: security, abuse, fraud, or spam.
- You have trained and fine-tuned transformer models yourself — data preparation, tokenizing code, LoRA/QLoRA or full fine-tunes, distillation, quantization — not only called hosted APIs.
- Classic ML depth: gradient boosting, linear models on sparse features, calibration, class imbalance, and judgement on when these beat an LLM.
- Evaluation discipline: leakage-free splits by time and family, precision at a fixed false-positive budget, regression sets, and an honest

📌 Senior Ml Engineer - Malware Detection (Remote Work) (Madrid)
🏢 CloudLinux
📍 Madrid