Application Security Engineer — Secure SDLC & AI Risks

Booking.com; Amsterdam; On-site; EUR 85,000 - 125,000; Full time

Benefits offered by this job

Health insurance

Headspace access

Pension plan

Annual paid time off

Parental leave - 22 weeks

Bereavement leave

Job summary

Booking.com is seeking an Application Security Engineer to safeguard customer data and build advanced security tooling. You will partner with product teams to embed security across the software development lifecycle and improve remediation practices.

You'll review applications and APIs, perform secure code reviews, and help implement SAST/DAST/SCA scans. A strong focus on threat modelling, security requirements, and hands-on automation is expected.

Qualifications

• Some experience with application security tools such as SAST, DAST, software composition analysis, vulnerability scanners, or secrets-scanning tools.
• Bachelor's or Master's degree in Computer Science or a related field.
• 3+ years of relevant industry experience.
• Familiarity with common risks such as injection, broken access control, authentication failures, security misconfigurations, XSS, and insecure dependencies.

Responsibilities

• Review applications, APIs, and designs to identify basic security risks.
• Support secure code reviews and vulnerability assessments.
• Help teams understand and remediate common web vulnerabilities.
• Contribute to threat modelling and security requirements for new features.
• Help integrate security checks in CI/CD pipelines (SAST, DAST, SCA, secrets scanning).
• Support security reviews of AI- and LLM-enabled applications where applicable.
• Investigate security findings, assess priority, and track remediation.
• Document findings, security requirements, procedures, and recommendations.

Skills

SAST

DAST

Software composition analysis

Vulnerability scanners

Secrets scanning

Python scripting

Bash scripting

OWASP Top 10

Secure coding principles

Cloud platforms

Containers

APIs security

Threat modelling

Security testing

AI/LLM security

Education

Bachelor's or Master's degree in Computer Science or related field

Tools

SAST tools

DAST tools

Job description

Booking.com is seeking an Application Security Engineer to safeguard customer data and build advanced security tooling. You will partner with product teams to embed security across the software development lifecycle and improve remediation practices.

You'll review applications and APIs, perform secure code reviews, and help implement SAST/DAST/SCA scans. A strong focus on threat modelling, security requirements, and hands-on automation is expected.