安全工程师 / 资深工程师
Security Engineer / Staff Engineer
Imunify360 是 Linux 基础设施和安全解决方案的领先开发者。我们的旗舰产品 Imunify360 是一个全面的安全套件，保护全球数千个共享主机环境、VPS 和独立服务器。我们的客户包括 Dell、GoDaddy、IBM 和 Zoom 等行业巨头，全球客户超过 4500 家。公司员工超过 250 人。
我们正在寻找一名工程师-架构师，从零开始构建一款新产品。这不是一个现有团队中的职位——你将独自为 Node.js 应用程序创建一个运行时保护层。托管市场正在迅速采用 Node.js，现代应用程序越来越多地由使用 AI 工具但缺乏技术安全知识的用户生成。你的任务是让保护自动进行，对客户端代码透明，并在实时中有效。
这是一个拥有最高所有权级别的职位（高级/资深/架构师级别），你将做出关键的架构决策并为结果负全责。
职责
- 定义在 Node.js 进程内部构建运行时保护的技术方案。
- 设计检测逻辑，在应用执行期间识别和阻止攻击。
- 在真实生产环境中构建并发布产品的第一个版本。
- 确保保护功能无需修改客户端代码，也不会破坏合法的应用程序。
- 根据遥测数据、生产反馈和真实事件持续改进产品。
- 在四个关键指标上达到目标值：
- 运行时开销
- 误报率
- 漏报率
- 客户升级数量
要求
首要优先级是安全，而不仅仅是 Node.js。安全经验比一般的后端经验更重要。
必须具备：
- 安全工程或安全研究经验（对攻击向量和防御方法有深入理解）。
- 独立从零开始构建并发布过产品/解决方案（端到端的所有权：从想法到生产）。
- 能够处理模糊的问题，定义解决方案，并在没有持续监督的情况下交付可行的结果。
- 有设计架构和做出关键技术决策的经验（具备资深/架构师级别经验是强烈加分项）。
- 英语水平：中级或以上（书面和口语 —— 所有面试均用英语进行）。
加分项：
- 具体在 Node.js 上的安全经验（漏洞相关）
查看英文原文
Imunify360 is a leading developer of Linux infrastructure and security solutions. Our flagship product, Imunify360, is a comprehensive security suite that protects thousands of shared hosting environments, VPS, and dedicated servers worldwide. Our clients include industry giants such as Dell, GoDaddy, IBM, and Zoom, with over 4,500 customers globally. The company has more than 250 employees.
We are looking for an engineer-architect to build a new product from scratch. This is not a position within an existing team—you will single-handedly create a runtime protection layer for Node.js applications. The hosting market is rapidly adopting Node.js, and modern applications are increasingly generated by users with AI tools and little technical security expertise. Your mission is to make protection automatic, transparent to client code, and effective in real time.
This is a role with the highest level of ownership (Senior / Staff / Architect level), where you will make key architectural decisions and take full responsibility for the outcome.
Responsibilities
- Define the technical approach for building runtime protection inside the Node.js process.
- Design the detection logic to identify and block attacks during application execution.
- Build and launch the first version of the product in real production environments.
- Ensure the protection works without requiring changes to client code and without breaking legitimate applications.
- Continuously improve the product based on telemetry, production feedback, and real-world incidents.
- Achieve target values across four key metrics:
- Runtime overhead
- False positives
- False negatives
- Customer escalation volume
Requirements
The top priority is Security, not just Node.js. Security experience outweighs general backend tenure.
Must-have:
- Experience in Security Engineering or Security Research (deep understanding of attack vectors and defense methods).
- Have independently built and shipped a product/solution from scratch (end-to-end ownership: from idea to production).
- Ability to take an ambiguous problem, define a solution, and deliver a working result without constant supervision.
- Experience designing architecture and making key technical decisions (Staff/Architect level is a strong plus).
- English language: Intermediate or higher (written and spoken — all interviews are conducted in English).
Nice-to-have:
- Security experience specifically in the context of Node.js (vulnerability analysis, securing, researching Node.js applications).
- Experience with Linux in production and development environments.
- Knowledge of Runtime Protection, WAF, instrumentation, malware analysis, and Incident Response.
- Experience in managed hosting / VPS domains.
- Experience with AI coding agents (Copilot, Cursor, etc.).
Important: If you are a Security Engineer / Researcher who doesn't code on a daily basis, you must be comfortable using AI-assisted development tools and be capable of building an MVP with their help.
Who you are (mindset):
- Builder: You genuinely enjoy creating something new and seeing it run in production.
- High ownership: You don't wait for tasks to be assigned — you define the approach and own the results.
- Practioner: You write code (yourself or with AI), not just review and coordinate.
- You understand Detection Engineering — how detection rules behave at scale across thousands of servers and the true cost of false positives.
We do NOT consider candidates who:
- Have only theoretical or research experience without shipping real products.
- Have general Node.js development experience but lack a security component.
- Reside in countries with complex B2B tax reporting requirements (USA, UK, Canada, Germany, France, and others — to be clarified during screening).
- Have frequent job changes (every 1–2 years) without valid reasons.
Benefits
- Format: 100% remote work anywhere in the world.
- Legal setup: B2B only (contract with your sole proprietorship or company).
- Budget: Up to $12,000 gross/month (before taxes, under a B2B agreement).
- Company: A stable, established international product company with 15+ years in the market.
- Role: A key position in building a new product line from the ground up.
Originally posted on Himalayas