AI Security Red Team Engineer

Refractal Ltd; Greater London; Hybrid; GBP 65,000 - 125,000; Full time

Benefits offered by this job

Salary range £65k–£125k

Competitive equity

Pension contribution

Private medical & dental

Visa & relocation support

Job summary

Refractal Ltd in Greater London seeks an experienced security tester to evaluate AI systems under adversarial pressure. You will design and run authorised assessments of AI applications and agents, and translate findings into stronger defences with the engineering and research teams.

The role requires hands-on offensive security with web apps/APIs, authentication and permission concepts, plus the ability to automate tests and explain practical impact.

Qualifications

• Hands-on experience in offensive security or adversarial testing of AI systems.
• Strong understanding of web applications, APIs, authentication and common security failure modes.
• Knowledge of how AI prompts and tools interact with data, memory and trust boundaries.
• Ability to write code to automate testing, reproduce findings and inspect behaviour.
• Ability to explain technical findings in terms of practical impact.

Responsibilities

• Design and execute assessments of AI applications and agents, grounded in attacker goals and test scope.
• Test threats such as prompt injection, misuse of connected tools, data exposure and permission boundary breaches.
• Create reproducible test cases and small tools to demonstrate impact and differentiate failures.
• Analyse how model behaviour and system design create vulnerabilities.
• Document findings, propose mitigations and retest fixes with engineers.

Skills

Offensive security

Application security

Adversarial testing

Web apps & APIs

Auth & permissions

Prompts & AI security

Automated testing

Communicating findings

Job description

Refractal Ltd in Greater London seeks an experienced security tester to evaluate AI systems under adversarial pressure. You will design and run authorised assessments of AI applications and agents, and translate findings into stronger defences with the engineering and research teams.

The role requires hands-on offensive security with web apps/APIs, authentication and permission concepts, plus the ability to automate tests and explain practical impact.