Fractional CTO

About Kimetai

Kimetai is building the European governance platform for AI agents and automations, based on enforcement: identity, pre-execution blocking of unauthorised actions, and immutable audit trails with qualified timestamping.

We sell to the European mid-market (50–500 employees), with the CISO, the DPO and the compliance lead as our buyers. We design against real regulatory anchors: GDPR, NIS2, DORA, the AI Act and eIDAS 2, with data residency exclusively within the EU.

Our stack: a Go monorepo (control plane), Rust at the cryptographic boundary over gRPC, a Next.js/React console, OPA embedded as the policy engine, and PostgreSQL with forced Row Level Security for tenant isolation at the database layer.

We build with a hybrid human-agent engineering system: state-of-the-art coding agents governed by a cycle of domain review, security review and human approval on every PR.

We have an advanced MVP, currently integrating with the n8n workflow orchestration ecosystem — and growing.

The role: a two-phase path

We are looking for one person for a path with two stages. We start with a fractional engagement — the senior judgment a security platform needs from day one — and, if it works for both sides, the position evolves into a full-time CTO with a seat on the leadership team once the company closes its first external round. The first phase is, deliberately, the best possible way for us to get to know each other.

Phase 1 — Fractional CTO. Immediate start. Commercial services contract (independent professional or company), non-exclusive, with a non-compete undertaking in the governance of enterprise AI agents and automations, and assignment of intellectual property to Kimetai. 4–8 days per month, with agreed peaks around key product milestones.

Fully remote.

Focus: senior judgment on architectural decisions and direct work in code alongside the founder — an engineer with a technical background and experience in startup development and go-to-market — on the platform components taken onto the product roadmap.

Compensation: market day / hourly rate. There is also the option to agree a participation in the value of the company — a phantom-shares plan vesting on tenure and milestones — if you would prefer a different split between guaranteed pay and success-linked upside.

Phase 2 — Full-time CTO. At the opening of our first external investment round. Permanent appointment as CTO, with a seat on the leadership team. Full-time, hybrid model with headquarters in Madrid (Spain). Focus: full technical leadership — architecture, founding engineering team, security certifications, and technical representation before customers and investors. Compensation: salary package, reviewed as the company hits its milestones, plus the option to invest at round-1 valuation.

What we expect

• A builder-leader with your hands in the code today: depth in Go (our control plane) and fluency in TypeScript; the ability to review Rust at the cryptographic boundary with sound judgment, and the drive to grow and lead the engineering team as we scale.
• Depth in backend and distributed systems: PostgreSQL with Row Level Security, append-only/event-sourced data models, and high-concurrency, low-latency APIs — our authorisation decision has to return in milliseconds.
• Applied security and cryptography: OAuth 2.0 / OIDC, Ed25519 signing, hash-chained ledgers, W3C DIDs and Verifiable Credentials, and policy engines (OPA / Rego or equivalent).
• Hands-on experience with the agent stack you will integrate: OpenAI and Anthropic APIs, orchestration platforms (n8n, Make, Zapier, LangChain), Microsoft/Google ecosystems for enterprise directory management, and the ability to integrate with SaaS such as Salesforce, Zoho or HubSpot. Experience building systems on MCP.
• Cloud infrastructure and European sovereignty: containerised deployments, IaC, observability, and the discipline to keep data resident in the EU.
• Judgment for regulated products: eIDAS timestamps, GDPR data flows and AI Act, NIS2 or DORA documentation are design inputs here, not paperwork — and you can defend the architecture in front of a customer's CISO.
• Strong English, spoken and written, and the communication skills to explain the technical foundations of Kimetai's infrastructure to customers (CISOs and CTOs) and investors.

Responsibilities

• Lead the platform architecture end to end: identity for agents and automations (DIDs/VCs), OPA-based policy engine, authorisation gateway and hash-chained audit ledger.
• Design for the guarantees we sell: pre-execution enforcement in milliseconds, tenant isolation at the database layer, and expertise in the (cyber)security of the infrastructure and services whose residency we ground exclusively in the EU.
• Contribute directly in code across the components and PRs on the product roadmap, pairing with the founder: Gateway, policy engine, cryptographic boundary, database-level security, signing and verification.
• Hold the quality bar of our hybrid human-agent engineering system: review of architectural decisions, threat model, and controls over agent-generated code.
• Build and run the connector ecosystem — n8n, OpenAI, Anthropic, Make, Zapier, Salesforce and Microsoft — and the SDKs and MCP server on top of it.
• Lead the security posture and the road to SOC 2 / ISO 27001, and join the founder in customer security reviews.
• In the full-time phase: hire and shape the founding engineering team, and own the technical dossier that investors and regulators will scrutinise.

What we offer

• A clear and honest path: an initial fractional engagement, with the option of a seat as CTO at the close of the first round if the results of the engagement are satisfactory.
• A phantom-shares plan: participation in the value we create, vesting on business milestones and tenure, contractually backed.
• The option to invest in the company at first-round valuation.
• Hybrid work with headquarters in Madrid; fully remote during phase 1.
• A high ceiling: direct ownership of your area in a company aiming to define a category — verifiable governance of AI agents and automations — in Europe.

Selection process

1. Initial conversation: mutual fit, availability and absence of conflicts of interest.
2. In-depth technical session: we will work on our real architecture. We want to see how you think, and to understand your capabilities.
3. Professional references: we will need validation from a client or from project colleagues.
4. An initial collaboration period with defined deliverables before activating the participation in value. We prefer to prove the fit to each other by working on something real.

Intellectual property and confidentiality

All intellectual and industrial property arising from work carried out within this collaboration — code, designs, technical documentation, architecture and any other deliverable — shall be the exclusive property of Kimetai Labs, S.L., in both the fractional and the full-time phase. The entire interview process will be treated as confidential, whatever its final outcome.

How to apply

Write to us at [email protected] and:

(1) send us your profile (CV, LinkedIn) — we also appreciate a link to your presence on GitHub, X, …;

(2) tell us about the most demanding security or identity system you have worked on and what your specific contribution was, and

(3) tell us why you would like to be part of our project. We reply to every application.

Read the full role description on our site: https://kimetai.com/en/roles/cto (ES: https://kimetai.com/es/roles/cto)