Lead Security Engineer - Vulnerability Response (Imunify360)

Accountabilities

• Own the vulnerability response pipeline: Design, build, and operate an end-to-end workflow covering vulnerability intake, triage, analysis, AI-assisted rule generation, testing, release, and public disclosure.
• Expand automated WAF protection: Extend the existing AI-assisted vulnerability response pipeline from WordPress plugin protection to ModSecurity and Coraza WAF rules.
• Develop and maintain security rules: Write, review, and refine ModSecurity/SecLang rules to detect and mitigate real-world web application vulnerabilities and attack patterns.
• Validate protection before release: Build automated test harnesses that evaluate rules against known exploits, representative traffic, and legitimate requests to minimize false positives and avoid disrupting customer websites.
• Integrate AI into security workflows: Use AI and large language model (LLM) tools to accelerate vulnerability analysis and rule generation, while implementing validation processes to ensure the accuracy and reliability of generated outputs.
• Lead and mentor security analysts: Manage priorities, review technical work, support professional development, and remove blockers to help the team deliver effective protection quickly.
• Measure and improve outcomes: Define, monitor, and continuously improve key performance indicators, including time-to-protection, critical vulnerability coverage, and false-positive rates.
• Automate security advisories: Integrate public advisory generation into the vulnerability response pipeline and collaborate with marketing to establish appropriate formats, review processes, and publication workflows.
• Analyze vulnerabilities and exploits: Interpret vulnerability disclosures, advisories, and source code changes to understand exploit mechanisms and translate findings into effective defensive rules.
• Balance speed and precision: Make informed decisions under time pressure while ensuring that new security controls protect customers without blocking legitimate traffic.
• Drive continuous improvement: Identify bottlenecks across the response process, improve automation and testing, and ensure the pipeline evolves with emerging threats and customer needs.

Requirements

• At least 5 years of experience in web or application security, including vulnerability research, detection engineering, WAF engineering, or a closely related field.
• Deep understanding of common web application attack classes, including SQL injection (SQLi), cross-site scripting (XSS), remote code execution (RCE), authentication bypass, path traversal, file upload vulnerabilities, and insecure deserialization.
• Strong practical experience writing WAF rules using ModSecurity/SecLang, OWASP Core Rule Set (CRS), or comparable technologies.
• Proficiency with regular expressions and the ability to translate observed attack patterns into accurate, effective detection rules.
• Ability to read and analyze PHP source code and understand vulnerabilities through security advisories, patches, and code diffs.
• Strong Python programming skills, including experience building and maintaining production-grade automation pipelines.
• Experience with CI/CD workflows, automated testing, and integrating validation into software delivery processes.
• Regular hands-on use of AI and LLM tools, with sound judgment about their limitations and the ability to independently verify generated analysis and code.
• Demonstrated ability to lead a technical project end to end, from defining the objective and designing the solution through implementation, deployment, and performance measurement.
• A product-oriented mindset, with the ability to evaluate technical decisions in terms of customer impact, operational risk, and measurable outcomes.
• Strong ownership and problem-solving skills, including the ability to identify process bottlenecks and address underlying causes rather than isolated symptoms.
• Clear communication skills, with the ability to explain technical issues, raise risks early, and collaborate effectively with cross-functional teams.
• Ability to remain calm and make sound decisions under pressure, including when responding to critical vulnerabilities and incomplete information.
• English proficiency at upper-intermediate level or higher.

Nice-to-have qualifications

• Experience with WordPress ecosystem security, including plugin vulnerabilities and vulnerability intelligence sources such as Wordfence, Patchstack, or WPScan.
• Experience with CVE attribution, vulnerability disclosure processes, or bug bounty programs.
• Familiarity with Coraza or other Web Application Firewall engines.
• Background in exploit analysis, threat intelligence, or security research.
• Experience with Linux server administration or the web hosting industry.

Benefits

• Fully remote work: Work remotely from Poland or another permitted location worldwide, with flexible working hours and the freedom to organize your schedule.
• Paid vacation: 24 days of paid vacation annually.
• Public holidays: 10 days of national holidays.
• Sick leave: Unlimited sick leave.
• Healthcare support: Financial compensation toward private medical insurance.
• Coworking reimbursement: Support for coworking expenses.
• Sports and wellness: Reimbursement for gym memberships or other sports-related expenses.
• Professional development: Dedicated education budget to support ongoing learning and skill development.
• Innovative contributions: Opportunity to receive a reward for an innovative idea that the company can patent.
• Technical challenges: Work on complex security problems involving AI-assisted automation, vulnerability research, and real-world web protection.
• Leadership opportunities: Lead and mentor security analysts while influencing the strategy and performance of a critical security response capability.
• Flexible, remote-first culture: Join an environment that emphasizes ownership, professional growth, and effective collaboration across distributed teams.