Staff Security Engineer, Imunify360

• Lead response to large-scale exploitation and malware campaigns, including triage, root cause analysis, and mitigation across every protection layer.
• Reverse-engineer malware and exploits targeting Linux servers and web applications.
• Track campaigns over time by clustering indicators, connecting activity to known actors and toolkits, and anticipating variants.
• Define and run measurable campaign outcomes, including time to detect, time to protect, cleanup effectiveness, and reinfection rate.
• Own the security incident and response process for customer threats and product vulnerabilities, including severity models, runbooks, communications, and escalation.
• Coordinate with software vendors, partners, CERTs/CSIRTs, abuse desks, and security vendors; drive responsible disclosure.
• Act as the technical voice in security advisories and partner briefings with Product and Support.
• Triage external vulnerability reports.
• Red-team the product and infrastructure and threat-model new features before release.
• Own the security review gate for high-risk changes and turn findings into fixes.
• Improve detection quality through false-positive budgets, test corpora, staged rollouts, measurement gates, and rollback.
• Build and automate analysis pipelines using dynamic analysis, honeypots, telemetry-driven hunting, and ML-assisted triage where useful.
• Write production code for security tools, spending approximately 30–50% of time hands-on building.
• Turn telemetry into intelligence and share internal briefs and selected public research.
• Mentor analysts and engineers and serve as a bar-raiser in security hiring loops.
• Deliver key milestones at 30 days, 90 days, 6 months, and 12 months, including production detections, response processes, campaign post-mortems, red-team reviews, fixes, metrics, and public research or disclosures.

• 10+ years in security engineering, malware research, incident response, or offensive security, with several years leading cross-team work at Staff/Principal/Lead scope.
• Deep hands-on malware analysis and reverse engineering skills.
• Strong web application security and practical exploitation experience.
• Deep Linux knowledge from both the attacker's and the defender's side.
• Proven incident response leadership on large-scale events: you have run the response, written the advisory, and closed the post-mortem.
• Production coding in Python plus a systems language (Go, Rust or C).
• Experience with coordinated vulnerability disclosure and working with the security community.
• Clear, short writing for both engineers and non-technical stakeholders; works well async across time zones.
• Daily user of AI tools for analysis and coding, with critical judgment about their output.
• Background in hosting or large web ecosystems is nice to have.
• Detection authoring at scale (signatures, WAF/IDS rules) is nice to have.
• Kernel-level monitoring and rootkit detection is nice to have.
• Threat intelligence practice and actor tracking is nice to have.
• ML for malware classification is nice to have.
• Public track record: CVEs, published research, talks, CTFs, open-source security tools is nice to have.
• Relevant certifications are a plus, not a requirement.

• Stay hands-on technically while owning complex, high-impact engineering work.
• Work on challenging Linux, automation, and cybersecurity problems across mature and newer products.
• Influence technical direction and make meaningful architectural decisions.
• Work independently with a high level of ownership and autonomy.
• Fully remote work with flexible working hours.
• 24 paid vacation days, 10 national holidays, and unlimited sick leave.
• Private medical insurance compensation.
• Co-working and gym/sports reimbursement.
• Education budget.
• Opportunity to receive a reward for innovative ideas that the company can patent.