Application Security Engineer

About Us: At Booking.com, data drives our decisions. Technology is at our core. And innovation is everywhere. But our company is more than datasets, lines of code or A/B tests. We’re the thrill of the first night in a new place. The excitement of the next morning. The friends you encounter. The journeys you take. The sights you see. And the memories you make. Through our products, partners and people, we make it easier for everyone to experience the world.
About the team: Our security team protects Booking.com’s websites, mobile apps and APIs from attacks and automated abuse. We build and operate security controls, including web application firewalls, bot detection and rate limiting, and use security data to identify and respond to threats. We work with product and engineering teams to improve protection while keeping services reliable and minimising the impact on legitimate customers and partners.

Role Description: Help protect customer-facing applications and APIs by engineering runtime security controls, improving application-focused detection, and providing hands-on technical support during security incidents. You will operate WAF protections delivered through infrastructure as code and CI/CD, use SIEM and application telemetry to investigate suspicious activity, and act as a third-line escalation for application security incidents.

Your expertise will directly contribute to the detection, prevention, and response to application security threats across Booking.com’s global platform.

Key responsibilities

• Build and maintain application protections. Implement, operate and improve WAF policies for internet-facing applications and APIs, including managed rule configuration, custom rules, rate limits and exceptions. Make changes through CDK and CI/CD, with appropriate review, validation, rollout monitoring and rollback plans.

• Make prevention practical. Assess how application-layer threats and observed attack patterns should be addressed at the edge. Tune controls to reduce exposure while managing false positives and service impact; work with service owners to validate changes and explain their effect.

• Improve detection and visibility. Use WAF, SIEM and relevant application or cloud telemetry to identify gaps in coverage. Create or tune detection logic, queries, alert context and investigation playbooks so that suspicious activity can be assessed quickly and consistently.

• Investigate and respond. Provide third-line technical escalation for application-facing security incidents. Triage escalated alerts, establish what happened and which services or users may be affected, preserve relevant evidence, and coordinate containment or mitigation with incident leads and service owners.

• Improve controls from incidents. Document findings and recommendations, identify recurring patterns, and recommend proportionate improvements to WAF policy, detections, logging, runbooks or automation. Implement assigned changes and track the actions you own to completion, coordinating with relevant owners when needed.

• Automate routine work. Write and maintain scripts or small tools that improve the safety, repeatability and efficiency of security operations, WAF changes, alert investigation and response workflows.

• Collaborate on scoped work. Most work is owned within Security Engineering. Coordinate with application, platform, security operations and incident response partners to implement agreed WAF or detection changes and investigate escalations. Share findings, promote relevant security practices and raise broader trade-offs or priorities with senior colleagues.

• Support teammates. Share practical guidance and help junior colleagues handle established WAF, detection and response tasks; bring novel or complex scenarios to senior colleagues.

What we are looking for

• Approximately 3–5 years of experience in security engineering, application security, cloud security, detection and response, or a closely related hands-on role; a relevant bachelor’s degree or equivalent practical experience.

• Practical experience designing, operating or tuning web application firewall controls. AWS WAF experience is strongly preferred.

• Experience managing security configuration through code and delivery pipelines, with a working understanding of infrastructure as code and safe change practices. AWS CDK experience is an advantage.

• Ability to investigate web and API activity using SIEM or log analytics tools: formulate queries, correlate events, assess alert quality and explain what the evidence does and does not show.

• Working knowledge of HTTP, web applications and APIs, common application-layer attack patterns, and how edge controls can mitigate them.

• Hands-on scripting or programming skills in Python, TypeScript, JavaScript, or a comparable language, used to automate or support security work.

• Experience participating in security incident investigations, including triage, scoping, evidence gathering, containment coordination and clear documentation.

• Clear communication and sound judgement: able to handle common tasks independently within team priorities, collaborate with partners on defined work, and seek support when a situation is unusual, complex or has broader impact.

Nice to have

• Experience with AWS security and logging services, WAF log analysis, or cloud-native application environments.

• Familiarity with SIEM detection engineering, alert tuning, incident playbooks, or security automation.

• Experience handling WAF false positives, application availability concerns, or coordination during a live security event.

• Knowledge of OWASP web and API risks, bot or automated abuse patterns, and practical edge mitigation approaches.

• Experience using version control and code review to manage security infrastructure changes.

What success looks like

You deliver reliable, reviewed protection and detection changes within team priorities; investigate escalations with evidence and clear reasoning; and coordinate timely mitigations during incidents. You own common tasks, contribute to improvements selected by the team, and bring complex or exceptional cases to senior colleagues with a concise assessment and recommended next steps.

Benefits & Perks - Global Impact, Personal Relevance:

Booking.com’s Total Rewards Philosophy is not only about compensation but also about benefits. We offer a competitive compensation and benefits package, as well unique-to-Booking.com benefits which include:

• Annual paid time off and generous paid leave scheme including: parent, grandparent, bereavement, and care leave

• Hybrid working including flexible working arrangements, and up to 20 days per year working from abroad (home country)

• Industry leading product discounts - up to 1400 per year - for yourself, including automatic Genius Level 3 status and Booking.com wallet credit

• Living and working in Amsterdam, one of the most cosmopolitan cities in Europe

• Contributing to a high scale, complex, world renowned product and seeing real-time impact of your work on millions of travelers worldwide

• Working in a fast-paced and performance driven culture

• Opportunity to utilize technical expertise, leadership capabilities and entrepreneurial spirit

• Promote and drive impactful and innovative engineering solutions

• Technical, behavioral and interpersonal competence advancement via on-the-job opportunities, experimental projects, hackathons, conferences and active community participation

• Competitive compensation and benefits package and some great added perks of working in the home city of Booking.com

Diversity, Equity and Inclusion (DEI) at Booking.com: 

Diversity, Equity & Inclusion have been a core part of our company culture since day one. This ongoing journey starts with our very own employees, who represent over 140 nationalities and a wide range of ethnic and social backgrounds, genders and sexual orientations.

Take it from our Chief People Officer, Paulo Pisano: “At Booking.com, the diversity of our people doesn’t just build an outstanding workplace, it also creates a better and more inclusive travel experience for everyone. Inclusion is at the heart of everything we do. It’s a place where you can make your mark and have a real impact in travel and tech.”

We ensure that colleagues with disabilities are provided the adjustments and tools they need to participate in the job application and interview process, to perform crucial job functions, and to receive other benefits and privileges of employment.

Application Process: 

• Let’s go places together: How we Hire
  

• This role does not come with relocation assistance.

Booking.com is proud to be an equal opportunity workplace and is an affirmative action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. We strive to move well beyond traditional equal opportunity and work to create an environment that allows everyone to thrive.

Pre-Employment Screening

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.