Lead Security Engineer - Vulnerability Response (AI)

Location: Remote worldwide; listed remote locations include Warsaw, Prague, Sofia, Bucharest, Madrid, and Tbilisi.

Company

hirify.global is a global remote-first company developing high-volume, low-cost Linux infrastructure and security products, including the Imunify360 Security Suite for shared, VPS, and dedicated servers.

What you will do

• Design and build the AI-driven pipeline from vulnerability disclosure through intake, triage, WAF rule drafting, testing, release, and public advisory.
• Extend the existing WordPress protection pipeline to ModSecurity and Coraza WAF rules.
• Write and review WAF rules for real-world web vulnerabilities and build test harnesses against exploits and real traffic.
• Lead and mentor security analysts, set priorities, review work, and remove blockers.
• Define and improve time-to-protection, critical-vulnerability coverage, and false-positive metrics.
• Automate advisory generation and coordinate the format and review flow with marketing.

Requirements

• 5+ years of experience in web or application security, including vulnerability research, detection engineering, WAF engineering, or similar work.
• Deep understanding of SQL injection, XSS, RCE, authentication bypass, path traversal, file upload, deserialization, and their detection in HTTP traffic.
• Hands-on experience writing WAF rules with ModSecurity/SecLang, OWASP CRS, or similar tools, together with regular expressions.
• Ability to read PHP code and understand vulnerabilities from advisories or patch diffs.
• Strong Python experience building production automation pipelines, with CI/CD and automated testing.
• Daily hands-on use of AI/LLM tools, including verification of their output.
• Proven experience leading a technical project end to end and applying a product mindset focused on customer impact.
• Upper-intermediate English or better.
• Strong ownership, process-level thinking, clear communication, early risk escalation, composure under pressure, and comfort making decisions with incomplete information.

Nice to have

• WordPress ecosystem security, including plugin vulnerabilities, Wordfence, Patchstack, WPScan, CVE credits, or bug bounty experience.
• Coraza or other WAF engines.
• Exploit analysis or threat intelligence experience.
• Linux server administration or hosting industry experience.

Culture & Benefits

• Fully remote work from any location worldwide with flexible working hours.
• 24 paid vacation days, 10 national holidays, and unlimited sick leave.
• Private medical insurance compensation.
• Co-working and gym or sports reimbursement.
• Professional development focus and an education budget.
• Reward opportunity for the most innovative patentable idea.