Senior Monitoring Engineer - a venture between Thales and Google

Thales is a global technology leader trusted by governments, institutions, and enterprises to tackle their most demanding challenges. From quantum applications and artificial intelligence to cybersecurity and 6G innovation, our solutions empower critical decisions rooted in human intelligence. Operating at the forefront of defence and security, aerospace and space, cybersecurity and digital identity, we’re driven by a mission to build a future we can all trust.

In Romania, we are advancing innovation through software engineering, research and development, delivering solutions in key markets in which Thales Group operates. Our engineers design, develop and integrate solutions that impact global industries – from fully operational systems and subsystems for naval warfare and maritime security operations, to air traffic management systems, satellite-based solutions, tactical indoor simulations, identity and biometric technologies and more.

📍 Bucharest - Hybrid (3 office / 2 remote) | Occasional travel to Paris
🗓 Start: ASAP | English-speaking team

In most jobs, your detection rules catch alerts.
In this one, they catch what regulators are watching for.

🌍 THE PROJECT

A trusted, sovereign Google Cloud region - operated end-to-end from within Europe by the joint venture between Thales and Google Cloud.

Same Google Cloud power you know (GKE, compute, data, Vertex AI).
European jurisdiction. European operators. Thales-grade cybersecurity.

In the last 6 months alone, the platform:
✅ Achieved a world-first regulatory qualification - IaaS + CaaS + PaaS in a single decision
✅ Named 2026 Google Cloud Partner of the Year - Sovereign Cloud
✅ Runs 3 data centres, 10,000+ devices, H100 GPU clusters in production
✅ Protects workloads in energy, banking, healthcare and defense

Your job: build the SIEM and detection capability that proves it stays secure - every second of every day.

🛠 WHAT YOU'LL OWN

▸ Deploy and operate the ELK stack (Elasticsearch, Logstash, Kibana) as platform-wide SIEM
▸ Design log ingestion pipelines - collection, normalization, enrichment, correlation
▸ Develop and maintain detection rules and SOC cookbooks
▸ Tune false-positive rates and improve threat detection coverage
▸ Optimize SIEM performance for high-volume, regulated workloads
▸ Lead incident investigations and forensic analysis
▸ Ensure compliance with security and regulatory requirements

🎯 WHAT WE'RE LOOKING FOR

Must-have:
▸ 5–8 years in Security / SIEM / DevSecOps
▸ Strong hands-on with the ELK stack
▸ Solid SIEM and security monitoring experience
▸ Deep knowledge of log analysis, correlation and detection
▸ Strong understanding of security events and threat models
▸ Solid Linux fundamentals, comfortable in English

Nice to have:
▸ SOC experience
▸ Cloud environments (GCP preferred)
▸ Kubernetes logging
▸ Compliance / regulated environments

💡 WHY THIS ROLE IS DIFFERENT

In a sovereign cloud, security monitoring isn't a feature - it's the regulatory contract.
You design that contract.
You sit at the table with Google Cloud and Thales security engineering, not behind it.
Greenfield SIEM scope: you define the standard, not maintain legacy.

🎁 WHAT YOU GET

Competitive package + private medical, meal vouchers, sport benefit, and the rest of the Thales standard package. Real ownership in a Bucharest-based team protecting European critical infrastructure.

👋 SOUND LIKE YOU?

If you've built SIEM at scale, write detection rules that actually catch things, and want a Bucharest-based role where security monitoring really matters - let's talk.

At Thales, we’re committed to fostering a workplace where respect, trust, collaboration, and passion drive everything we do. Here, you’ll feel empowered to bring your best self, thrive in a supportive culture, and love the work you do. Join us, and be part of a team reimagining technology to create solutions that truly make a difference – for a safer, greener, and more inclusive world.