Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 67 days ago

Product & Infrastructure Security Engineer

UltaHost208 open roles

Where
Astana
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowProduct & Infrastructure Security EngineerUltaHost · Astana

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on UltaHost's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

11.9% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.1%1 day
  2. 4.4%3 days
  3. 11.9%7 days
  4. 18.6%14 days
  5. 35.6%30 days
  6. 45.1%60 days
This job: posted 67 days ago

The posting

Job Overview

UltaHost is looking for a Senior Product & Infrastructure Security Engineer to take ownership of the security of our hosting products and the infrastructure that delivers them. This is a deeply technical, hands-on position combining product security, application security, Linux/server security, virtualization, network security, vulnerability management, and DDoS incident response. We are looking for someone who understands security not only from a testing perspective, but from the realities of operating and protecting production hosting infrastructure.

What You’ll Own

Hosting Product & Application Security

  • Review the security of VPS, VDS, dedicated servers, shared hosting, WordPress, cloud, Mac hosting, email hosting, game hosting, customer portals, control panels, APIs, and internal hosting platforms.
  • Assess authentication, authorization, session security, tenant isolation, secrets handling, privileged operations, and data-exposure risks.
  • Perform threat modeling, architecture reviews, security testing, API security reviews, and release risk assessments.
  • Define security requirements and release checks for new products, major features, and sensitive platform changes.
  • Work with Product, Engineering, DevOps, and QA teams until vulnerabilities are remediated, retested, and closed.

Server, Virtualization & Network Security

  • Define secure baselines for Linux servers, hypervisors, control panels, network devices, firewalls, storage systems, and management interfaces.
  • Review SSH configurations, exposed ports and services, routing, DNS, firewall rules, segmentation, management access, and privilege boundaries.
  • Secure environments involving Proxmox, KVM, VMware, Ceph, containers, VPS nodes, dedicated infrastructure, and data-center connectivity.
  • Investigate brute-force attacks, malware, suspicious processes, privilege escalation, lateral movement, data exfiltration, and abnormal traffic.
  • Own technical DDoS/DoS response, including traffic analysis, mitigation, provider escalation, evidence collection, and post-incident reviews.

Vulnerability & Technical Incident Management

  • Run vulnerability scanning, configuration audits, patch-risk assessments, and targeted penetration testing.
  • Prioritize vulnerabilities according to actual customer and infrastructure risk.
  • Assign remediation owners and deadlines and verify that fixes are effective.
  • Lead product and infrastructure security incidents.
  • Support internal security incidents when servers, networks, or applications are involved.

What We’re Looking For

  • 5+ years of hands-on experience in hosting security, infrastructure security, Linux security, network security, product security, cloud security, or a closely related role.
  • Advanced Linux administration skills.
  • Real-world experience with VPS, dedicated servers, shared hosting, control panels, hypervisors, storage, or large multi-tenant environments.
  • Experience with Proxmox, KVM, VMware, Ceph, containers, or equivalent virtualization and cluster technologies.
  • Strong knowledge of TCP/IP, DNS, routing, firewalls, VPNs, segmentation, and traffic analysis.
  • Hands-on experience detecting and mitigating DDoS attacks.
  • Strong understanding of OWASP Top 10, API security, authentication, authorization, session security, tenant isolation, secrets management, and secure release practices.
  • Experience with vulnerability scanners, penetration-testing tools, SAST/DAST, dependency scanning, configuration reviews, tcpdump, Wireshark, and log analysis.
  • Ability to investigate compromised servers, malware, brute-force attacks, web attacks, privilege escalation, and abnormal network behavior.

Preferred Background

Direct experience in a web hosting company, cloud provider, ISP, CDN, data center, infrastructure vendor, or MSSP is highly preferred. Preferred certifications include OSCP, OSWA, CCNP Security, GIAC, Security+, CISSP, cloud-security certifications, or equivalent practical expertise. Certifications are valuable, but real production experience is more important.

What Success Looks Like

You will help us achieve:

  • Earlier detection of critical vulnerabilities before release or exploitation
  • Faster containment of product, server, network, and DDoS incidents
  • Reduction of exposed high-risk services and unsafe configurations
  • Reduction of overdue vulnerabilities
  • Secure baseline coverage across Linux, virtualization, network, and hosting products
  • Stronger product-security reviews and remediation verification
  • Prevention of recurring security weaknesses

Important

This is not a general penetration-testing position. We need someone who can secure and investigate real production hosting infrastructure not someone whose experience is limited to vulnerability testing and producing penetration-test reports. You will work closely with our Internal Security & Security Operations Engineer and collaborate with Product, Engineering, DevOps, Network, QA, Support, Abuse, and executive management. If Linux, networks, virtualization, hosting infrastructure, product security, and incident response are where you do your best work, we’d like to hear from you.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against UltaHost's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on UltaHost's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    UltaHost's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.