This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior ML Engineer
- Malware Detection based remotely in Spain. The Senior ML Engineer will develop and deploy advanced machine learning solutions to detect web-based malware across large-scale Linux hosting environments. Working with an extensive dataset of real-world malware samples, analyst decisions, detection rules, and cleanup outcomes, you will transform production intelligence into more accurate and efficient security systems. Your work will span classical machine learning, transformer models, LLM-assisted triage, and automated signature generation. You will own the journey from raw data and experimentation to production deployment, with success measured by real detection improvements and controlled false-positive rates. Collaborating closely with malware analysts, infrastructure specialists, and fellow ML engineers, you will have access to dedicated GPU resources and modern AI-assisted development tools. This remote-first opportunity is idóneo for an experienced ML practitioner who thrives on experimentation, rigorous evaluation, and delivering measurable cybersecurity impact. Accountabilities:
* Machine Learning Model Development: Design, train, fine-tune, and deploy ML models using production malware data to improve detection coverage and identify threats that traditional signatures and rules may miss.
* Malware Classification and Triage: Develop models that distinguish malicious files from benign content, prioritize suspicious files for deeper inspection, and route samples to the most appropriate detection engines.
* Automated Signature Generation: Build systems that generate detection signatures from emerging malware campaigns,



helping security analysts respond faster to new and evolving threats.
* Context-Aware Threat Detection: Develop methods to identify malicious content that requires contextual analysis, including phishing pages, webshells, script injections, and compromised website components.
* Detection and Cleanup Optimization: Improve detection precision and cleanup effectiveness so that infected websites remain clean after remediation and recurring threats can be identified.
* Model Evaluation and Validation: Establish rigorous evaluation frameworks using time-based and campaign-based dataset splits, historical false-positive and false-negative cases, and regression testing to prevent data leakage and verify improvements before deployment.
* Inference and Resource Optimization: Optimize model throughput, latency, CPU usage, memory consumption, and cost per file to support reliable deployment across large hosting fleets.
* Production Deployment and Monitoring: Move models from experimentation into production, using shadow deployments and controlled releases to gather evidence before enabling live detection.
* Continuous Learning and Retraining: Incorporate fresh analyst feedback and newly identified false negatives into training datasets, establish regular retraining cycles, and monitor trends in detection rates and model performance.
* ML Infrastructure and Experimentation: Develop reusable training pipelines, maintain dataset tooling, make effective use of GPU resources,



and enable multiple parallel research and development efforts.
* Cross-Functional Collaboration: Work closely with malware analysts, detection engineers, and infrastructure teams to investigate customer-reported detection failures, understand emerging threats, and translate operational findings into model improvements.
* Technical Documentation and Knowledge Sharing: Document architectural decisions, evaluation methods, model limitations, hardware requirements, and production results. Participate in asynchronous collaboration and blameless post-mortems to continuously improve engineering practices.
* Delivery Against Milestones: Train and evaluate an initial production-data model during the first month, bring multiple models into production or shadow testing by month three, and help establish ML as a major source of new detections within the first year.

Requirements:
The ideal candidate combines substantial production ML experience with hands-on transformer expertise, strong evaluation discipline, and the ability to engineer efficient models for adversarial security environments. You should be comfortable making evidence-based decisions, communicating asynchronously, and taking ownership of the full ML lifecycle. Key qualifications include:
* Production ML

Experience:
At least five years of experience building and deploying machine learning systems in production, including at least two years in an adversarial domain such as cybersecurity, fraud, spam, or abuse prevention.
* Transformer Model Expertise: Practical experience training and fine-tuning transformer models, including data preparation, code tokenization, LoRA/QLoRA or full fine-tuning, distillation, and quantization. Experience sh

📌 Senior ML Engineer (Islas Baleares)
🏢 Jobgether
📍 Islas Baleares