Senior Monitoring Engineer a venture between Thales and Google

Thales is a global technology leader trusted by governments institutions and enterprises to tackle their most demanding challenges. From quantum applications and artificial intelligence to cybersecurity and 6G innovation our solutions empower critical decisions rooted in human intelligence. Operating at the forefront of defence and security aerospace and space cybersecurity and digital identity were driven by a mission to build a future we can all trust.

In Romania we are advancing innovation through software engineering research and development delivering solutions in key markets in which Thales Group operates. Our engineers design develop and integrate solutions that impact global industries from fully operational systems and subsystems for naval warfare and maritime security operations to air traffic management systems satellite-based solutions tactical indoor simulations identity and biometric technologies and more.

Bucharest - Hybrid (3 office / 2 remote) Occasional travel to Paris
Start: ASAP English-speaking team

In most jobs your detection rules catch alerts.
In this one they catch what regulators are watching for.

THE PROJECT

A trusted sovereign Google Cloud region - operated end-to-end from within Europe by the joint venture between Thales and Google Cloud.

Same Google Cloud power you know (GKE compute data Vertex AI).
European jurisdiction. European operators. Thales-grade cybersecurity.

In the last 6 months alone the platform:
Achieved a world-first regulatory qualification - IaaS CaaS PaaS in a single decision
Named 2026 Google Cloud Partner of the Year - Sovereign Cloud
Runs 3 data centres 10000 devices H100 GPU clusters in production
Protects workloads in energy banking healthcare and defense

Your job: build the SIEM and detection capability that proves it stays secure - every second of every day.

WHAT YOULL OWN

Deploy and operate the ELK stack (Elasticsearch Logstash Kibana) as platform-wide SIEM
Design log ingestion pipelines - collection normalization enrichment correlation
Develop and maintain detection rules and SOC cookbooks
Tune false-positive rates and improve threat detection coverage
Optimize SIEM performance for high-volume regulated workloads
Lead incident investigations and forensic analysis
Ensure compliance with security and regulatory requirements

WHAT WERE LOOKING FOR

Must-have:
58 years in Security / SIEM / DevSecOps
Strong hands-on with the ELK stack
Solid SIEM and security monitoring experience
Deep knowledge of log analysis correlation and detection
Strong understanding of security events and threat models
Solid Linux fundamentals comfortable in English

Nice to have:
SOC experience
Cloud environments (GCP preferred)
Kubernetes logging
Compliance / regulated environments

WHY THIS ROLE IS DIFFERENT

In a sovereign cloud security monitoring isnt a feature - its the regulatory contract.
You design that contract.
You sit at the table with Google Cloud and Thales security engineering not behind it.
Greenfield SIEM scope: you define the standard not maintain legacy.

WHAT YOU GET

Competitive package private medical meal vouchers sport benefit and the rest of the Thales standard package. Real ownership in a Bucharest-based team protecting European critical infrastructure.

SOUND LIKE YOU

If youve built SIEM at scale write detection rules that actually catch things and want a Bucharest-based role where security monitoring really matters - lets talk.

At Thales were committed to fostering a workplace where respect trust collaboration and passion drive everything we do. Here youll feel empowered to bring your best self thrive in a supportive culture and love the work you do. Join us and be part of a team reimagining technology to create solutions that truly make a difference for a safer greener and more inclusive world.