Senior ML Engineer – Malware Detection

This is a fully remote position, open to applicants in Poland, +5 more countries.

📋 Description

• Determine which files on a server warrant detailed examination while adhering to strict CPU and memory constraints.

• Identify malicious code amidst benign code at fleet scale while keeping the cost per file reasonable.

• Automatically generate detection signatures from emerging malware campaigns.

• Recognize malware that is only contextually harmful, including phishing pages and script injections.

• Direct each file to the suitable detection engine.

• Ensure cleanup is accurate so that sites remain clean afterwards.

• Validate that each model enhances detection capabilities before being released to production.

• Take ownership of the process from raw samples to production models, showcasing measurable impact.

• Develop a first production-data model and evaluation framework within the initial month.

• Have multiple models operational by the third month, including shadow-mode and live models governed by past-error regression sets.

• Set up a GPU-utilizing training environment and propose the detection cascade along with cost-per-file and hardware specifications.

• Position models as a primary source of new detections by the end of the first year.

• Retrain using fresh analyst and false-negative labels on a consistent schedule.

• Incorporate generated signatures into the analyst workflow.

• Empower other engineers to execute two or three simultaneous training directions using the available tools.

• Collaborate daily with malware analysts, detection and infrastructure engineers, and the ML team.

• Document decisions with ADR-Lite and adhere to shipping gates to prevent increases in false positives or false negatives.

• Conduct blameless post-mortems within 24 hours.

⛳️ Requirements

• Over 5 years of experience in building ML systems deployed in production, including at least 2 years in an adversarial domain such as security, abuse, fraud, or spam.

• Proficient in training and fine-tuning transformer models, encompassing data preparation, code tokenization, LoRA/QLoRA or complete fine-tunes, distillation, and quantization.

• Expertise in classic ML methods: gradient boosting, linear models on sparse features, calibration, class imbalance, and knowing when these techniques surpass an LLM.

• Strong evaluation discipline: ensuring leakage-free splits by time and family, maintaining precision within a fixed false-positive budget, regression sets, and comprehending the differences between production and offline performance.

• Inference cost engineering skills: measuring throughput and latency while aligning models to CPU or memory budgets using ONNX, llama.cpp, vLLM, or int8/int4.

• Solid proficiency in Python, PyTorch, and the Hugging Face stack.

• SQL expertise with large analytical tables, such as ClickHouse or similar.

• Familiarity with PHP or JavaScript, or a willingness to learn while collaborating with malware analysts.

• Regular use of AI coding agents, with the capability to demonstrate their application.

• Proficient in English at an upper-intermediate (B2) level or higher, with particularly strong written communication skills for asynchronous work.

• Experience with web malware, webshells, phishing kits, or WordPress security is a significant advantage.

• Familiarity with AST or token features, code LLMs, and graph models based on program structure is a strong plus.

• Knowledge of malware clustering and similarity analysis is a considerable asset.

• Experience with multi-GPU training on personal bare metal, MLflow or Weights & Biases, and dataset versioning are strong advantages.

• Proficiency in Go or Rust for on-server inference is a notable plus.

• Published work or presentations on ML for security are also a strong advantage.

🏝️ Benefits

• Emphasis on professional development.

• Engaging and challenging projects.

• Fully remote work with flexible hours, allowing you to organize your day and work from any location globally.

• Paid 24 days of vacation annually.

• 10 days of national holidays.

• Unlimited sick leave.

• Coverage for private medical insurance.

• Reimbursement for co-working expenses.

• Gym and sports reimbursement.

• Budget allocated for education.

• Opportunity to earn a reward for the most innovative idea that the company can patent.

• Access to dedicated GPUs on the company's own bare metal for training purposes.

• Leadership's commitment to fund additional hardware when supported by data.