CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful.
Check out our website for more information: https://cloudlinux.com/Imunify360 is CloudLinux's security suite for Linux web servers: real-time and background malware scanning, automated cleanup, a WAF, runtime PHP protection (Proactive Defense), a database malware scanner, and IP reputation. It runs on hosting providers' shared, VPS, and dedicated servers, so new web-malware campaigns land on our fleet early.
We sit on one of the largest labeled corpora of live web-server malware in the industry: files, verdicts, cleanup outcomes, and analyst decisions collected from production hosting servers every day. It already drives our signatures, heuristics, and ML models, and there is far more to get out of it. We are looking for a Senior ML Engineer who will turn that data into detection that ships — classifiers, LLM-assisted triage and generated signatures — and keep exploring new ML/LLM methods against it, measured by the product's false-negative and false-positive rates, not by notebook accuracy.
Our dataset focuses on web malware — PHP, JavaScript, HTML phishing kits, infected WordPress and Joomla plugins and themes, database injections — with the context around each file.
What you'll work with:Malware samples from production servers,



with verdicts and analyst decisionsYears of signatures and detection rulesCustomer-reported false negatives and false positivesRuntime behavior of code on live sitesWeb-attack trafficFile metadata and how files spread across serversCleanup outcomes, including what came backWhat you will do:The goal is 10x more malware detected at the same or lower false-positive rate. Hand-written rules and faster pipelines will not get there; models trained on our data might.
Decide which files on a server deserve a closer look, within tight CPU and memory budgetsTell malicious code from benign at fleet scale and a sensible cost per fileGenerate detection signatures automatically from new campaignsCatch malware that only looks malicious in context, such as phishing pages and script injectionsRoute each file to the right detection engineMake cleanup precise so sites stay clean afterwardsProve each model improves detection before it shipsHow we work:You get an experimentation track, GPUs, and a direct line to leadership; in return, you bring numbers, not opinions.
Remote-first, async across UTC−5 to UTC+8. Decisions are written down (ADR-Lite) and public by defaultHardware follows evidence: Each training direction starts with dedicated GPUs on our own bare metal; leadership has committed to fund more when the case is made with dataAgentic engineering: Claude and Codex are the default tools, wired to GitLab, Jenkins, Redash, Jira, and Slite through MCP servers. We look at how engineers work with agents — context, specificity, review quality — not only at outputClose to ground truth: You work daily with malware analysts,



detection and infrastructure engineers, and the rest of our ML teamShip gates: No model or build goes out if it raises false positives or false negatives on our past-error sets. Blameless post-mortems within 24 hoursWhat you'll deliver:You own the path from raw samples to a model in production, and the numbers that prove it helped.
First month: A first model trained on production data and measured against today's engines — suspicious-file triage or a metadata model. The evaluation harness in place: splits by time and campaign so families don't leak, and a regression set from past FPs and FNsBy month 3: Several models in production: some in shadow mode building evidence, some live and producing real detections, all gated on the past-error regression set. A training setup that keeps its GPUs busy. A written proposal (ADR) for the detection cascade, with cost per file and hardware needsBy month 12: Models are a main source of new detections, reported as share of new detections and FN-rate trend. Retraining on fresh analyst and FN labels on a fixed cadence. Generated signatures inside the analyst workflow. Two or three parallel training directions that other engineers can run with your toolingIt is a strong plus if you have:Web malware, webshells, phishing kits or WordPress security experienceModels over code: AST or token features, code LLMs, graph models on program structureMalware clustering and similarity analysisMulti-GPU training on your own bare metal; MLflow or Weights & Biases; dataset versioningGo or Rust, for on-server inferencePublished work or talks on ML for securityBenefits:What's in it for you?A focus on professional developmentInteresting and challenging projectsFully remote work with adaptable working

📌 Senior ML Engineer (Madrid)
🏢 CloudLinux
📍 Madrid