Senior ML Engineer – Malware Detection

• Decide which files on a server deserve closer inspection within tight CPU and memory budgets
• Detect malicious code from benign code at fleet scale while maintaining a sensible cost per file
• Generate detection signatures automatically from new malware campaigns
• Detect malware that appears malicious only in context, including phishing pages and script injections
• Route each file to the appropriate detection engine
• Make cleanup precise so sites remain clean afterward
• Prove each model improves detection before production release
• Own the path from raw samples to production models and demonstrate measurable impact
• Build a first production-data model and evaluation harness during the first month
• Have several models in production by month 3, including shadow-mode and live models gated on past-error regression sets
• Establish a GPU-utilizing training setup and propose the detection cascade with cost-per-file and hardware requirements
• Make models a main source of new detections by month 12
• Retrain on fresh analyst and false-negative labels on a fixed cadence
• Integrate generated signatures into the analyst workflow
• Enable other engineers to run two or three parallel training directions using the provided tooling
• Work daily with malware analysts, detection and infrastructure engineers, and the ML team
• Document decisions using ADR-Lite and follow ship gates preventing increases in false positives or false negatives
• Conduct blameless post-mortems within 24 hours

• 5+ years building ML systems that ran in production, including 2+ years in an adversarial domain: security, abuse, fraud, or spam
• Experience training and fine-tuning transformer models, including data preparation, code tokenization, LoRA/QLoRA or full fine-tunes, distillation, and quantization
• Classic ML expertise: gradient boosting, linear models on sparse features, calibration, class imbalance, and selecting when these outperform an LLM
• Evaluation discipline: leakage-free splits by time and family, precision at a fixed false-positive budget, regression sets, and understanding differences between production and offline performance
• Inference cost engineering: measuring throughput and latency and fitting models to CPU or memory budgets using ONNX, llama.cpp, vLLM, or int8/int4
• Strong Python, PyTorch, and Hugging Face stack skills
• SQL proficiency on large analytical tables, such as ClickHouse or similar
• Familiarity with PHP or JavaScript, or willingness to learn it while working with malware analysts
• Daily use of AI coding agents, with ability to demonstrate how
• English at upper-Intermediate (B2) level or higher, with particularly strong written communication for async work
• Web malware, webshells, phishing kits, or WordPress security experience is a strong plus
• Experience with AST or token features, code LLMs, graph models on program structure is a strong plus
• Malware clustering and similarity analysis is a strong plus
• Multi-GPU training on own bare metal, MLflow or Weights & Biases, and dataset versioning are strong pluses
• Go or Rust for on-server inference is a strong plus
• Published work or talks on ML for security are a strong plus

• A focus on professional development
• Interesting and challenging projects
• Fully remote work with flexible working hours, allowing you to schedule your day and work from any location worldwide
• Paid 24 days of vacation per year
• 10 days of national holidays
• Unlimited sick leaves
• Compensation for private medical insurance
• Co-working reimbursement
• Gym/sports reimbursement
• Budget for education
• Opportunity to receive a reward for the most innovative idea that the company can patent
• Dedicated GPUs on the company's own bare metal for training directions
• Leadership commitment to fund additional hardware when supported by data