Application security engineer for APIs

Booking; Amsterdam; Hybrid; EUR 90,000 - 140,000; Full time

Benefits offered by this job

Hybrid work

Generous leave covering parental/berev

Booking.com discounts

Global impact

Job summary

Booking.com ищет специалиста по безопасности для защиты пользовательских приложений и API. Вы будете разворачивать и настраивать WAF, работать через инфраструктуру как код и CI/CD, анализировать инциденты с использованием SIEM и телеметрии, а также выступать как третий уровень эскалации при угрозах.

Кандидат имеет опыт в веб-приложениях, знание HTTP/APIs, скрипты на Python/TypeScript и практику в incident response.

Qualifications

• 3–5 лет опыта в инженерии безопасности, защите приложений и облаке.
• Практический опыт проектирования и настройки WAF.
• Опыт работы с инфраструктурой как код и CI/CD.

Responsibilities

• Развивать и поддерживать политики WAF для приложений и API.
• Использовать CDK и CI/CD для изменений с проверками и откатами.
• Анализировать интернет-активность через SIEM и телеметрию.
• Эскалация инцидентов 3-й линии и координация с владельцами сервисов.
• Документировать выводы и рекомендации по улучшениям WAF и детекции.

Skills

Security engineering

Cloud security

Incident response

Scripting

Education

Bachelor’s degree or equivalent

Tools

AWS WAF

AWS CDK

SIEM / log analytics

Python

TypeScript/JavaScript

Job description

Описание:

Help protect customer-facing applications and APIs by engineering runtime security controls, improving application-focused detection, and providing hands‑on technical support during security incidents. You will operate WAF protections delivered through infrastructure as code and CI/CD, use SIEM and application telemetry to investigate suspicious activity, and act as a third‑line escalation for application security incidents. Your expertise will directly contribute to the detection, prevention, and response to application security threats across Booking.com’s global platform.

Задачи:

Implement, operate and improve WAF policies for internet-facing applications and APIs, including managed rule configuration, custom rules, rate limits and exceptions. Make changes through CDK and CI/CD, with appropriate review, validation, rollout monitoring and rollback plans. Assess how application-layer threats and observed attack patterns should be addressed at the edge. Tune controls to reduce exposure while managing false positives and service impact; work with service owners to validate changes and explain their effect. Use WAF, SIEM and relevant application or cloud telemetry to identify gaps in coverage. Create or tune detection logic, queries, alert context and investigation playbooks so that suspicious activity can be assessed quickly and consistently. Provide third-line technical escalation for application-facing security incidents. Triage escalated alerts, establish what happened and which services or users may be affected, preserve relevant evidence, and coordinate containment or mitigation with incident leads and service owners. Document findings and recommendations, identify recurring patterns, and recommend proportionate improvements to WAF policy, detections, logging, runbooks or automation. Implement assigned changes and track the actions you own to completion, coordinating with relevant owners when needed. Write and maintain scripts or small tools that improve the safety, repeatability and efficiency of security operations, WAF changes, alert investigation and response workflows. Most work is owned within Security Engineering. Coordinate with application, platform, security operations and incident response partners to implement agreed WAF or detection changes and investigate escalations. Share findings, promote relevant security practices and raise broader trade‑offs or priorities with senior colleagues. Share practical guidance and help junior colleagues handle established WAF, detection and response tasks; bring novel or complex scenarios to senior colleagues.

Требования:

Approximately 3–5 years of experience in security engineering, application security, cloud security, detection and response, or a closely related hands‑on role; a relevant bachelor’s degree or equivalent practical experience. Practical experience designing, operating or tuning web application firewall controls. AWS WAF experience is strongly preferred. Experience managing security configuration through code and delivery pipelines, with a working understanding of infrastructure as code and safe change practices. AWS CDK experience is an advantage. Ability to investigate web and API activity using SIEM or log analytics tools: formulate queries, correlate events, assess alert quality and explain what the evidence does and does not show. Working knowledge of HTTP, web applications and APIs, common application‑layer attack patterns, and how edge controls can mitigate them. Hands‑on scripting or programming skills in Python, TypeScript, JavaScript, or a comparable language, used to automate or support security work. Experience participating in security incident investigations, including triage, scoping, evidence gathering, containment coordination and clear documentation. Clear communication and sound judgement: able to handle common tasks independently within team priorities, collaborate with partners on defined work, and seek support when a situation is unusual, complex or has broader impact. Будет плюсом: Experience with AWS security and logging services, WAF log analysis, or cloud‑native application environments; Familiarity with SIEM detection engineering, alert tuning, incident playbooks, or security automation; Experience handling WAF false positives, application availability concerns, or coordination during a live security event; Knowledge of OWASP web and API risks, bot or automated abuse patterns, and practical edge mitigation approaches; Experience using version control and code review to manage security infrastructure changes

Условия:

Annual paid time off and generous paid leave scheme including: parent, grandparent, bereavement, and care leave. Hybrid working including flexible working arrangements, and up to 20 days per year working from abroad (home country). Industry leading product discounts - up to 1400 per year - for yourself, including automatic Genius Level 3 status and Booking.com wallet credit Contributing to a high scale, complex, world renowned product and seeing real‑time impact of your work on millions of travelers worldwide Working in a fast-paced and performance driven culture Opportunity to utilize technical expertise, leadership capabilities and entrepreneurial spirit Promote and drive impactful and innovative engineering solutions Technical, behavioral and interpersonal competence advancement via on-the-job opportunities, experimental projects, hackathons, conferences and active community participation Competitive compensation and benefits package and some great added perks of working in the home city of Booking.com