Security Engineer: AI Threat Detection & Response

Refractal; Greater London; On-site; GBP 60,000 - 115,000; Full time

Benefits offered by this job

Competitive equity

Pension contribution

Private medical and dental cover

Visa and relocation support

Job summary

Refractal is seeking a hands-on security product professional to translate detection and investigation workflows into product requirements. You’ll work with software and research engineers, drawing on your experience writing detection rules and tuning SIEMs.

You’ll build realistic test cases, evaluate outputs, and ensure the product meets practitioner needs. This role includes influence on design, collaboration with customers, and opportunities to shape how AI threat detection is delivered.

Qualifications

• Hands-on experience writing and tuning detection rules.
• Practical experience using SIEM platforms to query security data and investigate activity.
• Experience understanding analyst workflows, false positives and telemetry gaps.
• Ability to explain security problems to software engineers and translate experience into requirements and test cases.

Responsibilities

• Translate detection and investigation workflows into product requirements for engineers and researchers.
• Use detection rules and SIEMs to guide product design and integration priorities.
• Build realistic test cases that capture attacker behavior, benign activity and false positives.
• Evaluate product outputs for detection quality, context, and analyst usability.
• Collaborate with customers and colleagues to identify gaps and prioritize improvements.

Skills

Detection rule writing

SIEM usage

Threat investigation

Requirements translation

Tools

Splunk

Datadog

Job description

Refractal is seeking a hands-on security product professional to translate detection and investigation workflows into product requirements. You’ll work with software and research engineers, drawing on your experience writing detection rules and tuning SIEMs.

You’ll build realistic test cases, evaluate outputs, and ensure the product meets practitioner needs. This role includes influence on design, collaboration with customers, and opportunities to shape how AI threat detection is delivered.