Security SRE - Bucharest Sovereign Cloud Hub

Location: Bucharest, Romania

Thales is a global technology leader trusted by governments, institutions, and enterprises to tackle their most demanding challenges. From quantum applications and artificial intelligence to cybersecurity and 6G innovation, our solutions empower critical decisions rooted in human intelligence. Operating at the forefront of defence and security, aerospace and space, cybersecurity and digital identity, we’re driven by a mission to build a future we can all trust.

 

In Romania, we are advancing innovation through software engineering, research and development, delivering solutions in key markets in which Thales Group operates. Our engineers design, develop and integrate solutions that impact global industries – from fully operational systems and subsystems for naval warfare and maritime security operations, to air traffic management systems, satellite-based solutions, tactical indoor simulations, identity and biometric technologies and more.

A trusted, sovereign Google Cloud region operated end-to-end from within Europe by the joint venture between Thales and Google Cloud. Same Google Cloud power (GKE, compute, data, Vertex AI), European jurisdiction, European operators, Thales-grade cybersecurity.

In the last 6 months alone: world-first regulatory qualification (IaaS + CaaS + PaaS in a single decision, SecNumCloud 3.2, December 2025), named 2026 Google Cloud Partner of the Year for Sovereign Cloud, 3 data centres, 10,000+ devices, NVIDIA H100 GPU clusters in production, workloads across energy, banking, healthcare, defense.

We are standing up the SRE function for this platform from scratch. Bucharest is the primary hub, Q3 / Q4 2026 hiring window. You are joining a greenfield team, not inheriting one.

You will design and operate the security foundations of a sovereign cloud region: HashiCorp Vault as a platform-wide secrets service, PKI hierarchies, Cloud KMS strategies, Keycloak identity federation, TPM/HSM trust roots, and ELK-based SIEM detection. You partner with platform, network, and data SRE teams to ensure security-by-design is a real engineering discipline, not documentation.

• Operate HashiCorp Vault at platform scale (topology, policies, secret engines, PKI backend)
• Design and operate Cloud KMS strategies (rotation, BYOK/HYOK, HSM integration)
• Own the platform PKI (root and intermediate CAs, cert lifecycle, mTLS patterns)
• Configure and maintain Keycloak / IDP federation for human and machine identities
• Implement ELK-based security monitoring (detection rules, log correlation, forensic workflows)
• Contribute to TPM/HSM attestation and hardware trust root patterns
• Drive incident response, post-mortems, and continuous improvement of the security posture
• Follow-the-sun on-call rotation with Google Cloud SRE teams

You have some or all of the following. We hire for depth in at least one area of the stack, breadth in the adjacent ones, and willingness to grow into the rest.

• Minimum 3 years in Site Reliability Engineering or Security Platform Engineering
• Deep hands-on with HashiCorp Vault (or equivalent enterprise secrets management)
• Solid IAM / Identity Providers (Keycloak, Workspace, Okta or similar)
• Hands-on KMS / encryption key management design and operations
• Strong Linux fundamentals and cloud security best practices
• Excellent English (international team, follow-the-sun on-call)

• Kubernetes secrets patterns (ESO, sealed-secrets, CSI driver)
• Terraform / IaC for security infrastructure
• SIEM / detection engineering with ELK
• Experience in regulated environments (banking, healthcare, defense, telco)
• TPM, HSM, or hardware trust root experience

• Greenfield SRE function, Bucharest hub. You catch the org before it exists. First hires shape the standard everyone else inherits.
• Accelerated Google training program on Google's internal technical stack (Borg, Colossus, Spanner) is planned as part of onboarding.
• Direct technical collaboration with Google Cloud SRE teams. Follow-the-sun on-call model with global coverage.
• Sovereign cloud, first-of-its-kind, SecNumCloud 3.2 qualified. Regulated workloads in banking, healthcare, energy, defense.
• Hyperscaler-level scale of operations from a single location. No relocation required.
• Competitive package, private medical, meal vouchers, sport benefit, and the rest of the Thales standard package.

Apply via the link in the first comment. We review Senior and Mid profiles within the same pipeline and route based on experience during first-stage screening.

At Thales, we’re committed to fostering a workplace where respect, trust, collaboration, and passion drive everything we do. Here, you’ll feel empowered to bring your best self, thrive in a supportive culture, and love the work you do. Join us, and be part of a team reimagining technology to create solutions that truly make a difference – for a safer, greener, and more inclusive world.