Platform Engineer

Refractal; Greater London; On-site; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Visa sponsorship

Job summary

Refractal is seeking a Platform Engineer to own the core product platform from external interface to service and data layers. You will focus on the APIs and SDKs used by customers to connect Refractal to their systems, building FastAPI services, authentication, multi‑tenant isolation, data contracts and event interfaces that enable seamless integrations.

You will also craft onboarding flows, policy integration and operator tools, with a dashboard powering secure, auditable enforcement decisions.

Qualifications

• Strong backend experience with HTTP APIs. Experience with Python and FastAPI, or similar tools, is preferred.
• Experience with observability and tracing systems. You can trace agent actions, tool calls, requests, spans and enforcement decisions across services.
• Experience with relational databases. This should include Postgres or SQLite, SQLAlchemy and database migrations.
• Experience in API design, versioning and compatibility. You can create SDKs, documentation and examples that make integration simple.
• A good understanding of authentication, sessions, API keys, authorisation and multi‑tenant access control.
• Experience with data models, event streams, audit records and error handling.
• The ability to work independently, communicate clearly and take ownership of technically uncertain customer problems.
• External API or SDK ownership from data model to customer use.
• Experience with B2B or enterprise integrations, trust/auditability/compliance importance.
• Experience with data‑dense or real‑time systems like security consoles or SSE.
• Experience with containers, CI/CD and cloud platforms (GCP).
• Experience in AI security or high‑assurance tech fields.
• Open‑source or side projects showing engineering decisions and product judgement.

Responsibilities

• Own the platform API and its SDKs. Define stable, versioned contracts, client interfaces, error behaviour, compatibility rules, documentation and examples.
• Design and build the FastAPI services behind these interfaces. Provide access to enforcement decisions, evidence, policies and red‑team results.
• Own identity and access at the platform layer, including authentication, sessions, API keys, authorisation and multi‑tenant access control.
• Design the platform's data and event interfaces, including read models, requests/spans, real‑time SSE streams and an audit ledger.
• Present security data accurately; avoid missing data or false values in APIs, SDKs and UIs.
• Build customer integration and onboarding flows: tenant setup, policy binding, integrations, sign‑in and API‑key issuance.
• Build the operator dashboard as a client of the platform API (heatmap, trajectories, traces, policy compiler, audit ledger).
• Work directly with customers; translate needs into clear product requirements.
• Define engineering standards for APIs, SDKs, components, tests and customer‑facing quality.

Skills

Python

FastAPI

HTTP APIs

Backend development

Observability

Tracing systems

Relational DB

SQLAlchemy

Auth & multi-tenant

Tools

PostgreSQL

SQLite

SQLAlchemy

GCP Cloud Run

Docker

CI/CD

Job description

Refractal is building security infrastructure for autonomous systems. Tomorrow’s attacks will use adaptive reasoning agents; cyber defenders need the right tools for adaptive defence. Refractal builds the Security Context Graph, which allows defenders to reason more effectively about risk and enforce controls.

Our founding team combines technical pedigree from MIT, NASA, Microsoft, and government with commercial experience in VC and startups. We have also been recognised by MIT's flagship CSAIL AI lab as part of CSAIL Alliances, as well as being selected as the only British AI Security company in Google's highly selective Gemini Cybersecurity Startup Forum. We are today working with leading, high-assurance AI startups and a European government to help secure their AI deployments.

The Mission

For most of the last decade, AI safety and security lived inside the frontier labs. It was seen as the preserve of the labs to ‘solve’ alignment at the model level, with too little consideration of downstream cybersecurity infrastructure.

2026 has ended this illusion. The gated release of Mythos, Cybersecurity over-refusal on Fable, and the incidents with Anthropic and OpenAI have all shown that the labs cannot be trusted to solve these problems alone. At the same time, the risks have moved beyond the models themselves: agents are being given credentials, tools, and decision-making authority faster than security can catch up, all while frontier models can be exploited for (or autonomously engage in) offensive cyber operations.

Europe is particularly vulnerable. With little domestic choice of frontier models, European defenders are forced to turn to either American models (and risk over-refusal mid-incident), or to Chinese models, which poses other governance questions.

Refractal is building a world‑class team of researchers and product builders to galvanise AI and Cyber talent across Europe and build a leading company in AI Security.

The Role: Platform Engineer

As a Platform Engineer, you will own the core product platform from the external interface to the service and data layers. Your main focus will be the APIs and SDKs that customers use to connect Refractal to their systems. You will also build the FastAPI services, authentication, multi‑tenant isolation, data contracts and event interfaces that support these integrations.

You will build customer onboarding, policy integration and operator tools. Refractal also has a dashboard that helps security teams inspect activity, review evidence, manage policy and act on enforcement decisions. The dashboard is powered by the core APIs and services that support customer integrations.

You will work directly with the founders and early customers. You will convert operational security needs into simple and reliable platform interfaces. You will also help set the technical direction, engineering standards and product roadmap.

What You'll Work On

• Own the platform API and its SDKs. Define stable, versioned contracts, clear client interfaces, error behaviour, compatibility rules, documentation and examples.
• Design and build the FastAPI services behind these interfaces. Provide access to enforcement decisions, evidence, policies and red‑team results.
• Own identity and access at the platform layer. This includes authentication, sessions, API keys, authorisation and multi‑tenant access control. A tenant must never have access to another tenant's data.
• Design the platform's data and event interfaces. This includes read models, request and span records, real‑time SSE streams and a tamper‑evident audit ledger.
• Present security data accurately. The API, SDKs and user interfaces must clearly identify data that is missing, not measured or not captured. They must never create false values.
• Build the customer integration and onboarding flows. This includes tenant setup, policy binding, integrations, sign‑in and API‑key issue.
• Build the operator dashboard as a client of the platform API. It includes the agent‑action heatmap, attacker trajectories, traces, policy compiler, decision traces and audit ledger.
• Work directly with customers. Understand their systems and operating processes, then convert these needs into clear product requirements.
• Define engineering standards for APIs, SDKs, components, tests and customer‑facing quality.

What We Are Looking For

We need a product‑minded platform engineer who takes end‑to‑end ownership. You can work from the data model to the external API, SDK and customer integration. You can also build operator tools when required.

You make complex systems clear and predictable. You understand that an incorrect permission, an unstable API or a misleading user interface can cause a serious security fault. You deliver small, correct changes and improve them with evidence. You do not spend months designing an abstraction before you test it. You use real system data and do not hide missing data with false or cosmetic states.

Most importantly, you want to build the platform that security teams use to deploy autonomous systems safely at scale.

Qualifications

We assess demonstrated ability, rather than a specific credential or number of years in industry.

You should have:

• Strong backend experience with HTTP APIs. Experience with Python and FastAPI, or similar tools, is preferred.
• Experience with observability and tracing systems. You can trace agent actions, tool calls, requests, spans and enforcement decisions across services.
• Experience with relational databases. This should include Postgres or SQLite, SQLAlchemy and database migrations.
• Experience in API design, versioning and compatibility. You can create SDKs, documentation and examples that make integration simple.
• A good understanding of authentication, sessions, API keys, authorisation and multi‑tenant access control.
• Experience with data models, event streams, audit records and error handling.
• The ability to work independently, communicate clearly and take ownership of technically uncertain customer problems.

Particularly strong signals include:

• An external API or SDK that you owned from the data model to customer use.
• Experience with B2B or enterprise integrations, especially where trust, auditability or compliance was important.
• Experience with data‑dense or real‑time systems, such as security consoles, observability tools, event streams or SSE.
• Experience with containers, continuous integration and deployment, and cloud platforms such as GCP Cloud Run and Cloud SQL.
• Experience in AI security, cyber security or another high‑assurance technical field.
• Open‑source or side‑project work that shows clear engineering decisions and good product judgement.

We do not expect any candidate to have worked across all of these areas.

What We Offer

• Competitive salary, meaningful founding equity, and a performance‑linked bonus.
• Direct influence over the product, its architecture, and company direction.
• Access to real, high‑consequence AI deployments rather than purely synthetic environments.
• The opportunity to establish Refractal's platform engineering function and grow into a senior technical leadership role.
• The chance to work directly with founders whose experience spans MIT, NASA, Microsoft, government, venture capital, and early‑stage technology companies.
• London‑based, with an in‑person culture. We sponsor UK Skilled Worker and can assist with Global Talent visas.

Our process is fast: an intro call with the founders, a technical deep‑dive on your past work, a short practical exercise, and an offer, typically within two weeks.