Senior ML Engineer (Malware Detection)

Location: Remote worldwide; async collaboration across UTC−5 to UTC+8

Company

hirify.global is a remote-first company developing Linux infrastructure and security products, including the Imunify360 security suite for web servers.

What you will do

• Build production ML systems that identify web malware across hosting-provider servers while maintaining or reducing false-positive rates.
• Develop models for suspicious-file triage, malicious-versus-benign classification, contextual detection, engine routing, and precise cleanup.
• Generate detection signatures automatically from new malware campaigns and integrate them into analyst workflows.
• Design evaluation harnesses with time- and campaign-based splits, past-error regression sets, and production-oriented metrics.
• Own the path from raw malware samples and analyst labels to production models, including shadow deployments, live detection, retraining, and GPU utilization.
• Collaborate with malware analysts, detection and infrastructure engineers, and ML engineers while documenting technical decisions.

Requirements

• 5+ years of experience building ML systems that ran in production, including 2+ years in an adversarial domain such as security, abuse, fraud, or spam.
• Hands-on experience training and fine-tuning transformer models, including data preparation, code tokenization, LoRA/QLoRA or full fine-tuning, distillation, and quantization.
• Strong classical ML knowledge, including gradient boosting, linear models on sparse features, calibration, class imbalance, and selecting classical models over LLMs when appropriate.
• Experience with leakage-free evaluation splits by time and family, precision at a fixed false-positive budget, regression sets, and assessing differences between offline and production performance.
• Experience measuring inference throughput and latency and fitting models to CPU or memory budgets using technologies such as ONNX, llama.cpp, vLLM, int8, or int4.
• Strong Python, PyTorch, and Hugging Face skills, plus SQL experience with large analytical tables such as ClickHouse.
• Familiarity with PHP or JavaScript, or willingness to learn it while working with malware analysts.
• Daily use of AI coding agents and the ability to demonstrate how they are used.
• English at upper-intermediate level (B2) or higher, with strong written communication for asynchronous work.

Nice to have

• Experience with web malware, webshells, phishing kits, or WordPress security.
• Experience with models over code, including AST or token features, code LLMs, and graph models on program structure.
• Experience with malware clustering and similarity analysis.
• Experience with multi-GPU training on owned bare-metal hardware, MLflow or Weights & Biases, and dataset versioning.
• Go or Rust experience for on-server inference.
• Published work or talks on ML for security.

Culture & Benefits

• Fully remote work from any location worldwide with flexible working hours.
• Async collaboration across UTC−5 to UTC+8, with written decisions and a remote-first working model.
• Access to experimentation infrastructure, GPUs, and dedicated bare-metal hardware based on evidence.
• Professional development support, an education budget, and challenging technical projects.
• 24 paid vacation days, 10 national holidays, unlimited sick leave, private medical insurance compensation, and co-working and gym or sports reimbursement.
• Opportunity to receive a reward for an innovative idea that the company can patent.