Security Engineering Lead

About Us
We are an early-stage technology company operating at the intersection of Energy and AI infrastructure, focused on developing a new generation of efficient and scalable computing infrastructure. Our approach combines distributed computing, modular infrastructure and energy efficiency to support the rapidly growing demand for AI and high-performance computing. The company is developing a new model for deploying compute capacity in a flexible and scalable way, with a strong focus on efficiency, sustainability, reliability and responsible infrastructure development. This is an opportunity to join a growing team at an early stage and contribute directly to the development of a new infrastructure platform, working at the intersection of power, data centers and advanced computing. Role Overview We are seeking a Security Engineer Lead to own the technical security of our self-contained, outdoor-deployable AI/HPC compute systems and the interconnected clusters these systems form: from the boot chain of each server to a sovereign, multi-tenant GPU cloud built on Talos and Kubernetes. As the first security hire, you will design the security architecture and build it hands-on, as code, in close collaboration with the software, hardware and network teams. We are looking for an engineer who is excellent in cloud-native infrastructure security, comfortable working down to firmware and hardware, and keen to grow into physical and OT security with the support of specialist partners. What You Will Deliver This is a high-impact, high-ownership role. You will define how our infrastructure protects its tenants, their data, and the systems themselves. Your security controls will be deployed across every compute unit and cluster we deliver. Within 6 months: You will deliver the security foundations of the first compute system prototype: a threat model of the system and its interconnected clusters, hardened Talos/Kubernetes baselines, identity, secrets and PKI foundations, a secured software supply chain (signed images, SBOM), and secure boot with TPM-based disk encryption on the reference nodes. Within 12 months: You will own the security posture of the first production-ready product: proven multi-tenant isolation with secure wipe between tenants, attestation gating node admission into clusters, tamper detection and key zeroization tested with the hardware team, detection and incident-response playbooks in place, and a first external penetration test of the system.

Key Responsibilities
• Own the threat model and security architecture of the compute system and interconnected clusters, from firmware to platform.
• Harden the Kubernetes/Talos platform: CIS baselines, admission control (OPA/Kyverno), runtime security (e.g. Falco/Tetragon), and NetworkPolicies.
• Own identity, secrets and PKI: OIDC single sign-on and RBAC, secrets management (e.g. Vault), an internal PKI, and key and certificate lifecycle.
• Secure the boot chain with the hardware team: secure boot, TPM-based measured boot and attestation, and signed firmware.
• Guarantee multi-tenant isolation (KubeVirt, MIG, encryption, secure wipe) and secure the software supply chain (SBOM, cosign/sigstore, scanning, GitOps).
• Define the security requirements of the physical compute infrastructure (tamper detection, key zeroization on intrusion, access control) and its OT interface with energy assets, with the support of external specialists.
• Build detection and incident response capabilities and act as technical responder during incidents; work with the Network Architect on segmentation and zero-trust, and with the GRC & Compliance Manager on audit evidence. Requirements
• Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent field.
• 7–10 years of hands-on experience in infrastructure, platform or cloud security, ideally including bare-metal infrastructure.
• Deep, hands-on expertise in Kubernetes and Linux security.
• Solid practical experience with identity, secrets and PKI, and with software supply-chain security.
• Working knowledge of secure boot, TPM 2.0 and disk encryption on physical servers.
• Ability to work in a fast-paced, early-stage environment with a high degree of ownership and autonomy.
• English speaking. Nice to Have
• Familiarity with the target stack (Talos Linux, Cilium, KubeVirt, Ceph, GitOps/FluxCD).
• Experience with remote attestation, HSMs, or confidential computing.
• Exposure to industrial/OT security (e.g. IEC 62443), ideally in the energy sector.
• Prior experience at a hardware or infrastructure startup or scale-up, where scope and pace require broad ownership. Salary RAL 60.000€
- 100.000€ + equity (The compensation package will be determined based on the candidate’s seniority, experience, and level of expertise.) Location Milan, Italy.