Research Engineer / Research Scientist, Confidential Computing in London

The team builds and tests tools to verify agreements about AI. We prototype new verification mechanisms, lead international research collaborations, and work with policymakers around the world to show what these tools can do and inform how they’re used. You’d join a small team combining technical expertise with international AI policy experience.

The problem of verifying what happens inside a datacenter running large AI models is a bottleneck on almost every serious agreement about AI. One solution puts its trust in hardware: a trusted execution environment isolates a computation and attests to what ran inside it. Confidential computing exists on current accelerators and runs near production speed, unlocking several problems.

Your work would involve establishing what attestation on current accelerators does and does not prove, designing a registry that lets an outsider check an attested claim without anyone's permission, and making attested pipelines that hold together when someone hostile pulls on them. You'd work alongside cryptographers and hardware-security colleagues on the team and with external partners, and you'd be expected to publish since the whole approach depends on other people being able to check it.

Representative projects include:

• Establishing what a GPU confidential-computing attestation guarantees on current hardware, and publishing where it breaks.
• Designing and building the registry: the attested-result format, the submission path for third-party auditors, and a verification client someone outside the trust chain can actually run.
• Building attested logging inside an enclave, and working out what a privacy-preserving audit over those logs can and cannot establish.
• Running an evaluation end to end under mutual secrecy, with an attestation recording whose code and whose weights were involved.
• Chaining attestations across a pipeline so a claim about a final output stays checkable back to its inputs.
• Getting a confidential-computing stack running on accelerators from more than one supply chain.
• Combining hardware attestation with the team's cryptographic work.
• Red-teaming our own attestation chain.

About you: We care more about ability and trajectory than years of experience. You may be a good fit if you:

• Have built something real with confidential computing or hardware enclaves or have strong systems security fundamentals.
• Understand attestation chains well enough to know where they carry weight and where they are decoration.
• Are hard to reassure: you read a security claim and look first for what it does not say.
• Can ship an integration across organisational boundaries.
• Thrive in ambiguous, early-stage environments where defining the problem is part of the job.

Strong candidates may also have:

• ML inference serving experience and the operational scars of production deployment.
• Background in audit, certification, or PKI.
• Privacy-preserving computation experience beyond enclaves.
• Familiarity with the AI evaluations landscape.
• Experience explaining a hardware guarantee to someone who will never read a datasheet.

Role Logistics & Benefits: This is a remote role that can be based in Singapore, the UK, or remotely. For candidates interested in relocating, SASH can provide visa sponsorship in the UK. Our team is globally distributed, so remote team members should be comfortable maintaining some working-hour overlap with colleagues across regions.

Compensation takes location, experience, and level into account. Salaries above the stated range may be available for exceptional candidates. Benefits include competitive benefits and leave policies.