🇵🇱 Warsaw, Poland · 2w ago
Founding RASP Engineer - Node.js (remote-only)
CloudLinux
LinkedInseniorEnglish-friendly
CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful.Check out our website for more information https://cloudlinux.com/Imunify360 Security Suite is a product of CloudLinux Inc., the maker of the #1 OS in security and stability for hosting providers. Imunify is an innovative security solution designed specifically for shared and VPS/Dedicated servers. The automated, easy-to-use solution with the six-layer approach to security delivers comprehensive and complete attack prevention.The missionWe protect web hosting providers and the sites running on their infrastructure through a defense-in-depth stack: web-server-layer WAF, runtime application self-protection for PHP, deep application integrations (WordPress plugins and similar), a malware scanner with cleanup capability, and network-layer firewalls and IP reputation. The pieces talk to each other, and the threat intelligence they generate at scale powers detection across the stack.Node.js is the segment of the hosting market growing fastest, and the next layer we want to build for it is runtime protection inside the Node.js process itself. Most Node.js workloads on managed hosting today are AI-generated web apps deployed by non-technical owners who can't, won't, and shouldn't be expected to patch their own code or audit their own dependencies. We're going to defend those apps anyway — at runtime, without their cooperation, without breaking them.You'll build that runtime protection layer end-to-end.What You'll OwnThe product. A brand-new product line, yours to define — what we intercept, what we don't, what the customer-visible surface looks likeThe technical approach. Instrumentation strategy, deployment shape, programming language — all open. You'll consult with our architects but the direction is yoursImplementation, end to end. You'll have the full tooling stack we provide — LLM subscriptions, modern dev infrastructure, the works. Use what makes you fastMethodology. How you build conviction in your detection logic — your callCross-layer signal. Our existing stack produces threat intelligence at unmatched scale: tens of millions of monitored sites, petabyte-scale malware sample storage, real-time domain and URL reputation, IP-level attack feeds. These are available for you to plug into. Use what helpsHow We'll Measure SuccessThe product is held to four numbers: runtime overhead, false positives, false negatives, and customer-escalation volume. They reflect what hosting providers and their customers care about. Hit them well and the product runs inside a meaningful slice of the modern Node.js web.What We're Looking ForAn experienced researcher or engineer who can build and iterate on a brand-new product, driving both the research and the development. The hard part of this work is knowing what's malicious, what's vulnerable, and what's just an unusual but legitimate pattern — and being right about it across the long tail of frameworks, libraries, and customer code we'll encounter in production.RequirementsMust have:Familiarity with the Node.js runtime and the JavaScript ecosystemStrong web application security fundamentals and current knowledge of practical exploitationA working sense of how detection rules behave at scale — what catches attackers without flagging the long tail of legitimate codeAbility to start as the PM, architect, lead engineer, and QA for this product. You ask for resources or help when you need them; you don't wait to be told what to doNice to have:Comfort directing AI coding agents to high-quality output — most of our engineering does this nowPrior work on runtime-protection products, application firewalls, or instrumentation toolingBackground in malware analysis or incident responseFamiliarity with managed-hosting environmentsPublic security research, vulnerability disclosures, or detection rulesets you've authoredWhat It's NotNot a scope-and-handoff role — you drive the work and own the outcomeNot a "platform team will productize this later" role — you ship to real customer fleets and watch the telemetry quicklyNot a spec-and-review role — you are hands-on every dayWhy this mattersMost managed-hosting customers are not developers. They cannot patch their apps. They cannot audit their dependencies. They will keep deploying vulnerable code from AI assistants because that's how modern web apps get built now. The textbook advice — "secure your code, audit your dependencies" — does not apply to themIf we don't intercept exploits at runtime, nobody will. The numbers you hit on detection, performance, and false positives will materially affect how much of the modern web stays online when the next exploit class dropsBenefitsWhat's in it for you?A focus on professional developmentInteresting and challenging projectsFully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwidePaid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leavesCompensation for private medical insuranceCo-working and gym/sports reimbursementBudget for educationThe opportunity to receive a reward for the most innovative idea that the company can patentBy applying for this position, you consent to the processing of your personal data as described in our Privacy Policy (https://cloudlinux.com/candidate-privacy-notice), which provides detailed information on how we maintain and handle your data.Sourced from LinkedIn. Relocantly aggregates public job postings; apply on the original site.