Security SRE Bucharest Sovereign Cloud Hub

Thales is a global technology leader trusted by governments institutions and enterprises to tackle their most demanding challenges. From quantum applications and artificial intelligence to cybersecurity and 6G innovation our solutions empower critical decisions rooted in human intelligence. Operating at the forefront of defence and security aerospace and space cybersecurity and digital identity were driven by a mission to build a future we can all trust.

In Romania we are advancing innovation through software engineering research and development delivering solutions in key markets in which Thales Group operates. Our engineers design develop and integrate solutions that impact global industries from fully operational systems and subsystems for naval warfare and maritime security operations to air traffic management systems satellite-based solutions tactical indoor simulations identity and biometric technologies and more.

A trusted sovereign Google Cloud region operated end-to-end from within Europe by the joint venture between Thales and Google Cloud. Same Google Cloud power (GKE compute data Vertex AI) European jurisdiction European operators Thales-grade cybersecurity.

In the last 6 months alone: world-first regulatory qualification (IaaS CaaS PaaS in a single decision SecNumCloud 3.2 December 2025) named 2026 Google Cloud Partner of the Year for Sovereign Cloud 3 data centres 10000 devices NVIDIA H100 GPU clusters in production workloads across energy banking healthcare defense.

We are standing up the SRE function for this platform from scratch. Bucharest is the primary hub Q3 / Q4 2026 hiring window. You are joining a greenfield team not inheriting one.

You will design and operate the security foundations of a sovereign cloud region: HashiCorp Vault as a platform-wide secrets service PKI hierarchies Cloud KMS strategies Keycloak identity federation TPM/HSM trust roots and ELK-based SIEM detection. You partner with platform network and data SRE teams to ensure security-by-design is a real engineering discipline not documentation.

• Operate HashiCorp Vault at platform scale (topology policies secret engines PKI backend)
• Design and operate Cloud KMS strategies (rotation BYOK/HYOK HSM integration)
• Own the platform PKI (root and intermediate CAs cert lifecycle mTLS patterns)
• Configure and maintain Keycloak / IDP federation for human and machine identities
• Implement ELK-based security monitoring (detection rules log correlation forensic workflows)
• Contribute to TPM/HSM attestation and hardware trust root patterns
• Drive incident response post-mortems and continuous improvement of the security posture
• Follow-the-sun on-call rotation with Google Cloud SRE teams

You have some or all of the following. We hire for depth in at least one area of the stack breadth in the adjacent ones and willingness to grow into the rest.

• Minimum 3 years in Site Reliability Engineering or Security Platform Engineering
• Deep hands-on with HashiCorp Vault (or equivalent enterprise secrets management)
• Solid IAM / Identity Providers (Keycloak Workspace Okta or similar)
• Hands-on KMS / encryption key management design and operations
• Strong Linux fundamentals and cloud security best practices
• Excellent English (international team follow-the-sun on-call)

• Kubernetes secrets patterns (ESO sealed-secrets CSI driver)
• Terraform / IaC for security infrastructure
• SIEM / detection engineering with ELK
• Experience in regulated environments (banking healthcare defense telco)
• TPM HSM or hardware trust root experience

• Greenfield SRE function Bucharest hub. You catch the org before it exists. First hires shape the standard everyone else inherits.
• Accelerated Google training program on Googles internal technical stack (Borg Colossus Spanner) is planned as part of onboarding.
• Direct technical collaboration with Google Cloud SRE teams. Follow-the-sun on-call model with global coverage.
• Sovereign cloud first-of-its-kind SecNumCloud 3.2 qualified. Regulated workloads in banking healthcare energy defense.
• Hyperscaler-level scale of operations from a single location. No relocation required.
• Competitive package private medical meal vouchers sport benefit and the rest of the Thales standard package.

Apply via the link in the first comment. We review Senior and Mid profiles within the same pipeline and route based on experience during first-stage screening.

At Thales were committed to fostering a workplace where respect trust collaboration and passion drive everything we do. Here youll feel empowered to bring your best self thrive in a supportive culture and love the work you do. Join us and be part of a team reimagining technology to create solutions that truly make a difference for a safer greener and more inclusive world.