The role

We are looking for an engineer who wants to apply ML to a real adversarial problem, where attackers actively evolve to evade you and turn to increasingly complicated schemes. As part of the Novel Classification team, you’ll use machine learning and AI to identify fraudulent content on the Internet, from phishing sites to the full breadth of online scams.

You’ll learn from experienced engineers and see your ideas in production within weeks, driving the automated blocking and takedowns that disrupt cybercrime at scale. Recent projects include multi-modal embeddings that power classification and search, LLM classifiers, computer vision models for logo detection, and ensemble predictors that combine visual and semantic signals. We keep a close eye on the field and adopt new models and techniques early when they look promising.

You’ll work across the full lifecycle: training and evaluating models, serving them on our GPU-backed Kubernetes clusters, wiring them into production classification systems, and watching how they behave against live attack traffic.

Day to day, you’ll be:

• Building, evaluating and tuning the classifiers that decide what gets blocked and taken down.
• Deploying and operating model serving infrastructure on Kubernetes, including LLM inference (e.g. vLLM).
• Optimising models for high-volume, low-cost serving.
• Running experiments against live data, measuring precision, recall and false positive rates, and using the results to decide what ships.
• Integrating models into our production classification platforms.
• Building the pipelines and monitoring behind the models: feature extraction, scheduled retraining, experiment tracking, and the metrics that prove a solution works.
• Investigating and fixing issues in production, from model regressions to performance bottlenecks.
• Working across the business with engineers and analysts who depend on our classifiers.

What you’ll need to be successful

• Strong web fundamentals: HTTP, DNS, and above all how websites work, from request to rendered page. You'll use them both to understand the resources we classify and to build high-performance webservers.
• A working understanding of machine learning fundamentals, such as training, evaluation, overfitting and precision/recall trade-offs. This could come from industry, research or substantial personal projects.
• Good written and verbal communication skills. The work the team does is complex, and we must be able to articulate the impact of our work clearly and concisely, to a wide range of stakeholders.
• An empirical mindset. You design experiments, measure outcomes, and use metrics to validate and demonstrate impact.
• Willingness to learn Go and modern Perl, including asynchronous programming.
• Strong attention to detail and a real sense of responsibility. Customers act on our classifications, and Netcraft's reputation depends on getting them right.

Bonus points if you have

• A keen interest in cybercrime or cybersecurity.
• Experience fine-tuning models, including evaluation.
• Experience with LLM agents, evaluation & serving (e.g. vLLM or llama.cpp).
• Familiarity with cloud-native technologies such as Kubernetes, Flux, Argo and API gateways.
• Experience with multi-modal models, embeddings or similarity search at scale.
• Experience with ML experiment tracking and workflow tooling, such as MLflow or Argo Workflows.
• Experience with SQL databases, including writing and optimising queries against large datasets.

Preferably based in London, though Manchester and Bath are also options.

At Netcraft we strongly believe in individual growth and development. Even if you can't tick every box above right now, please don't let it put you off applying.

The Reward Package: