Senior Security Engineer (Python, WordPress & PHP) (remote-only, Europe)

We are looking for a Senior Security Engineer who understands exploitation deeply but prefers building tooling and automation over one-off research. You will work on systems that:

• Automatically generate and validate exploit PoCs for known WordPress / PHP CVEs Analyze PHP execution traces from real zero-day attacks against WordPress installations

LLMs are a first-class component of this work-not a novelty-used to accelerate exploit reconstruction, PoC generation, and attack workflow automation.

This is an engineering role with offensive depth, not a traditional pentesting or red-team position.

What You'll Build

• Systems to ingest, normalize, and analyze PHP execution traces:

• Function calls, parameters, control flow, side effects
• No native binary reversing - focus is PHP-level execution and logic

• Tooling that infers:

• vulnerable code paths
• authorization and logic flaws
• nonce and state-handling weaknesses

• Automated pipelines that:

• convert CVE descriptions + PHP source code into working PoCs
• replay inferred exploit paths deterministically

• LLM-assisted frameworks for:

• exploit skeleton generation
• parameter and payload inference
• exploit mutation and robustness testing

• High-fidelity exploit simulations targeting:

• admin-ajax.php
• WordPress REST APIs
• plugin-specific endpoints

• Infrastructure that transforms exploit mechanics into signals usable by detection and prevention systems.

Do you have experience in WordPress?, Do you have a Master's degree?, + PHP execution model and request lifecycle

• WordPress internals (nonces, hooks, REST, admin flows)
• HTTP semantics, sessions, cookies, and authorization

• Proven ability to read, reason about, and exploit PHP source code.
• Strong Python engineering skills for building:

• automation pipelines
• analysis tooling
• exploit frameworks

Nice to have:

• Exploit framework usage experience like, MSF, Core Impact, Immunity Canvas.
• Prior experience using LLMs to automate exploit development:

• PoC generation
• workflow automation
• payload mutation or inference

• Experience with:

• execution traces or application-level call graphs
• fuzzing or vulnerability discovery pipelines

• Familiarity with tools like: WPScan, Nuclei, Metasploit, Burp.
• Contributions to exploit tooling, frameworks, or security automation. Public CVEs or PoCs (helpful but not required)

What's in it for you?

• A focus on professional development.
• Interesting and challenging projects.
• Fully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide.
• Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves.
• Compensation for private medical insurance.
• Co-working and gym/sports reimbursement.
• Budget for education.
• The opportunity to receive a reward for the most innovative idea that the company can patent.

Join a company where people build innovative products and thrive in a remote-friendly environment. 

🔗 Learn more:
 cloudlinux.com | imunify360.com | tuxcare.com