Security Engineer (Detection & Response)

About this role

About Refractal Refractal is an AI security company building the infrastructure organisations need to defend against autonomous AI threats. 2026 has shown that generally capable intelligence is here. The challenge now is modernising security to stop AI-enabled threats, whether they come from internal agents going rogue or from attackers using AI to become more dangerous. Refractal was founded on cybersecurity and AI expertise from MIT, Microsoft, NASA and the U.S.

Navy. Our product lets organisations detect AI-enabled threats at low cost without sacrificing detection quality. We take a practical approach to AI risk, combining proven cybersecurity methods with frontier AI security research. Today, we work with governments and organisations that can't afford to get security wrong. We're backed by leading deep-tech and cybersecurity investors and are growing the team to deliver on this mission.

The role You'll bring hands-on detection and response experience into Refractal's product. Working with our software and research engineers, you'll draw on your experience writing detection rules, using SIEMs and investigating threats to shape what we build. What you'll do Translate detection and investigation workflows into product requirements, helping engineers understand what security teams need and why. Use your experience with detection rules and SIEMs such as Splunk and Datadog to guide product design and integration priorities.

Build realistic examples and test cases that capture attacker behaviour, benign activity and common sources of false positives. Evaluate product outputs for detection quality, useful context and the effort required for an analyst to reach a decision. Work with customers and colleagues to identify gaps, prioritise improvements and check that changes address practical security needs. Success in your first six months You've translated important detection and response needs into clear product requirements and helped deliver improvements.

You've built representative test cases that help the team assess detection quality and investigation usefulness. You've established a feedback loop that brings practitioner experience into engineering and research decisions. About you: essential Hands-on experience writing and tuning detection rules, with examples of how you assessed whether they worked. Practical experience using SIEM platforms, including Splunk or Datadog, to query security data and investigate activity.