Principle Platform Engineer

CSS Labs is building Praesidius, a deep-tech cybersecurity platform for behaviour-triggered lateral movement prevention in enterprise environments. Praesidius is designed for the assume-breach era: the operating assumption is that an attacker may already be inside the perimeter, and the job of the platform is to make their next move economically and operationally impossible. The product uses virtual decoy assets called phantoms. Phantoms have no legitimate business purpose. Any interaction with a phantom is treated as malicious by construction. Signals are observed by watchdog agents, correlated by an on-prem control plane, and converted into containment actions through customer tooling such as Microsoft Defender for Endpoint, Microsoft Entra ID, Active Directory, Cisco Meraki and other security, identity, network and virtualisation platforms.

The immediate company milestone is to take Praesidius from concept and prototype into an enterprise proof of concept with academic/semi-academic support and enterprise design partner engagement. The first funded build is the on-prem version of the platform: a single-node customer-deployable system that proves discovery, phantom placement, malicious-touch detection, provenance mapping, response recommendation/execution and audit evidence generation.

What this person will build:

• Backend services for zones, assets, phantoms, alerts, response state, contracts, audit events and evidence generation.
• APIs used by the portal, watchdog, connector layer and detection engine.
• A PostgreSQL-backed data model that can evolve towards the full Merkle Ledger, Trust Contract and Audit architecture.
• A secure event pipeline from watchdog/connector signals through alert generation and response workflows.
• The first hash-chained audit log and evidence export primitives needed for enterprise review.

Core responsibilities:

• Translate the Praesidius engineering specification into a pragmatic POC architecture and implementation plan.
• Design and build backend services, APIs and internal module boundaries for the on-prem control plane.
• Own the PostgreSQL schema for assets, zones, phantoms, alerts, response state, policies, audit records and early trust-contract objects.
• Build robust ingestion and processing paths for watchdog events, phantom interactions, connector data and response actions.
• Implement authentication, authorisation and RBAC foundations in collaboration with the CTO and frontend engineer.
• Implement the first audit-chain primitives: structured audit entries, predecessor hashing, chain head signing hooks and evidence export APIs.
• Create engineering standards for code quality, testing, error handling, logging, security review and documentation.
• Work with the infrastructure engineer to package the control plane as an on-prem Docker Compose deployment with a clear path to Kubernetes later.
• Work with the detection engineer to ensure alert and response workflows are deterministic, recoverable and explainable.
• Support investor, design partner and Catapult/Innovate UK technical conversations where backend architecture or implementation credibility is relevant.

Required experience:

• 8+ years of professional software engineering experience, including ownership of production backend systems.
• Expert-level Python engineering experience.
• FastAPI, Pydantic, asyncio, SQLAlchemy or equivalent frameworks are highly relevant.
• Strong PostgreSQL experience, including schema design, migrations, indexing, transactional semantics and operational performance.
• Experience designing secure APIs and backend systems that need to be reliable, observable and auditable.
• Experience with Docker-based deployments and practical Linux systems engineering.
• Strong understanding of distributed-system trade-offs, even though the first POC is intentionally single-node.
• Ability to write clear technical documentation, decision records and implementation plans.
• Comfortable working in a small founding team where architecture, code, debugging, customer context and hiring input all overlap.
• Cybersecurity product experience in EDR, XDR, SIEM, SOAR, Zero Trust, identity security, network security or deception technology.
• Experience implementing cryptographic data structures, signed records, PKI integrations or tamper-evident audit systems.
• Experience with Microsoft security ecosystems such as Defender for Endpoint, Microsoft Graph, Entra ID or Sentinel.
• Experience building on-prem enterprise software, appliances or products that run inside customer-controlled environments.
• Previous founding engineer or technical lead experience in an early-stage company.