Network Security Engineer Lead
Pubblicato il 23-10-2026 - Stealth Startup in Italia
h3About Us /h3 pWe are an early-stage technology company operating at the intersection of bEnergy and AI infrastructure /b, focused on developing a new generation of efficient and scalable computing infrastructure. /p pOur approach combines bdistributed computing, modular infrastructure and energy efficiency /b to support the rapidly growing demand for AI and high-performance computing. /p pThe company is developing a new model for deploying compute capacity in a flexible and scalable way, with a strong focus on befficiency, sustainability, reliability and responsible infrastructure development /b. /p pThis is an opportunity to join a growing team at an early stage and contribute directly to the development of a new infrastructure platform, working at the intersection of bpower, data centers and advanced computing /b. /p h3Position Type /h3 pFounding member of the Security function, initially reporting to the Head of Software /p h3Role Overview /h3 pWe are seeking a Security Engineering Lead to own the security posture and compliance of our self-contained, outdoor-deployable AI/HPC compute systems and the meshed clusters they form. This is a founding security role: you will define the end-to-end security of the product and be hands‑on building it, before growing and helping lead the security function as the company scales. The role spans three connected worlds: platform and infrastructure security (a sovereign Kubernetes/Talos GPU cloud), product and system security (physical units deployed in the field), and compliance and governance (a sovereign, multi-tenant offering operating under EU regulation). We do not expect deep mastery of every security domain on day one: we are looking for someone with a holistic security vision and a proven ability to lead through security crises,
excellent in at least one core domain and with the appetite and ability to grow into the others. /You will define how our systems protect their tenants, their data, and themselves, and your security architecture will ship across every unit and cluster we deploy. /p h3Within 6 months /h3 pYou will own and deliver the security architecture of the first compute system prototype: a documented threat model of the system and mesh, hardened Talos/Kubernetes baselines, the identity, secrets and PKI foundations, a tenant-isolation model, and a first detection and incident‑response capability validated in the lab. This means driving security technology selection, making key design decisions, and working hands‑on to secure the platform and the software supply chain (signed images, SBOM) in our GitOps pipeline. /p h3Within 12 months /h3 pYou will own the security posture of the first production‑ready product: an industrialized, defense‑in‑depth platform with proven multi‑tenant isolation and secure wipe between tenants, and the compliance groundwork laid and ready for our first certification. Working closely with network, software, and hardware colleagues, you will deliver a security architecture that is documented, automated, auditable, and ready to scale into series deployment, and you will begin setting the standards and practices for a growing security team.
/p h3Key Responsibilities /h3 ul liOwn the end‑to‑end security posture and threat model of the system and meshed cluster, across product/system, platform, identity, data, and inter‑site security /li liDefine and implement defense‑in‑depth for the Kubernetes/Talos platform: node and cluster hardening (CIS benchmarks), admission control (OPA/Kyverno), runtime security (e.g. Falco), and NetworkPolicies /li liOwn identity, secrets, and PKI: OIDC single sign‑on and RBAC, secrets management (e.g. Vault), an internal PKI, and key/certificate lifecycle (HSM where required) /li liGuarantee multi‑tenant isolation: workload isolation across VMs and containers (KubeVirt, MIG), encryption, secure wipe between tenants, and attestation /li liStand up detection and incident response: security logging and SIEM, alerting, playbooks, and lead security crisis management end to end /li liSecure the software supply chain: SBOM, image signing (cosign/sigstore), dependency and infrastructure‑as‑code scanning, and secure GitOps practices /li liOwn security compliance and governance: drive the information security management system and the sovereignty roadmap (ISO/IEC 27001, SecNumCloud, NIS2/GDPR and EU‑cloud alignment), including policies, risk management, and audit readiness /li liContribute to product and system security together with the hardware team: secure boot, TPM/measured boot and attestation, supply‑chain integrity, and hardening of deployed units /li liCollaborate closely with network (segmentation, zero‑trust, mesh), software, and hardware colleagues, and produce security architecture documents, threat models, and operational runbooks /li liSet security standards and practices as the function grows, with a path to build and help lead a small security team /li /ul h3Requirements /h3 ul liBachelor's d