Refractal is an AI security company building the infrastructure organisations need to defend against autonomous AI threats. 2026 has shown that generally capable intelligence is here. The challenge now is modernising security to stop AI-enabled threats, whether they come from internal agents going rogue or from attackers using AI to become more dangerous.
Refractal was founded on cybersecurity and AI expertise from MIT, Microsoft, NASA and the U.S. Navy. Our product lets organisations detect AI-enabled threats at low cost without sacrificing detection quality. We take a practical approach to AI risk, combining proven cybersecurity methods with frontier AI security research.
Today, we work with governments and organisations that can't afford to get security wrong. We're backed by leading deep-tech and cybersecurity investors and are growing the team to deliver on this mission.
The roleOwn the core product platform from its external interfaces through the service and data layers. You will build the APIs and SDKs that connect Refractal to customer systems, along with the services, identity controls, and event contracts behind them.
Work directly with the founders and early customers to turn operational security needs into simple, reliable platform interfaces and operator tools.
What you'll work onOwn stable, versioned platform APIs and SDKs, including client interfaces, compatibility rules, documentation, and examples.
Build FastAPI services for enforcement decisions, evidence, policies, and red-team results.
Design authentication, sessions, API keys, authorisation, and rigorous multi-tenant isolation.
Build data and event interfaces, real-time streams, and a tamper-evident audit ledger.
Create customer onboarding, policy integration, and operator dashboard workflows.
Own testing and deployment across API compatibility, browser smoke tests, Cloud Run, and Cloud SQL.
A product-minded platform engineer who makes complex systems clear and predictable and takes ownership from the data model to the customer integration.
Strong backend experience with HTTP APIs; Python and FastAPI experience is preferred.
Experience with observability, tracing, relational databases, and database migrations.
Sound judgement around API design, versioning, SDKs, and compatibility.
A strong understanding of authentication, authorisation, API keys, and multi-tenant access control.
Good JavaScript and React skills for building operator-facing product surfaces.
The ability to work independently and own technically uncertain customer problems.
Radical transparency. We believe the best work happens when everyone feels able to give and receive honest, constructive feedback.
Public service. We see AI security as a form of public service. Getting the AI transition right means putting the right infrastructure in place to manage the threats that come with it, and our work helps protect the institutions and services society depends on.
Fail fast. We test ideas early, seek feedback and learn quickly. We experiment rapidly and change course when something isn't working, without compromising on security.
Pragmatism, not dogmatism. We choose approaches based on how well they solve the problem. That means combining established cybersecurity methods with frontier AI research, questioning our assumptions, and changing our minds when the evidence changes.
What we offerCompetitive salary, meaningful equity, and a performance-linked bonus.
Direct influence over the product, architecture, engineering standards, and company direction.
Real, high-consequence AI deployments rather than purely synthetic environments.
London-based, in-person work, with UK Skilled Worker visa sponsorship and support for Global Talent applications.
