Hybrid Application Security Engineer II – Secure by Design

Booking Holdings, Inc.; Amsterdam; Hybrid; EUR 80,000 - 120,000; Full time

Benefits offered by this job

Hybrid working

Annual paid time off

Product discounts

Amsterdam living

Hackathons and events

Job summary

Booking.com is seeking an Application Security Engineer to help safeguard our global platform. You will build and operate security tooling, automate remediation, and partner with product teams to embed security within the software lifecycle.

You will review designs, perform secure reviews, and contribute to threat modelling, with emphasis on SAST/DAST and secure AI/LLM integrations. Hybrid work in Amsterdam is offered.

Qualifications

• Basic to intermediate knowledge of application and web security.
• 3+ years of relevant industry experience.
• Familiarity with risks such as injection, broken access control, authentication failures, security misconfiguration, XSS, insecure dependencies.
• Understanding of OWASP Top 10 and secure coding principles.
• Familiarity with HTTP, APIs, authentication, authorization, and TLS.
• Ability to read and understand code in at least one programming language.
• Basic scripting or automation skills (Python, Bash).
• Some experience with security tools (SAST, DAST, SCA, scanners).
• Basic understanding of securing LLM applications (prompts, inputs/outputs).
• Ability to communicate findings clearly.
• Analytical mindset and willingness to learn.
• Bachelor’s or Master’s degree in CS or related field.

Responsibilities

• Review applications, APIs, and designs to identify basic security risks.
• Support secure code reviews and vulnerability assessments.
• Help teams understand and remediate common web vulnerabilities.
• Contribute to threat modelling and security requirements for new features.
• Help integrate and maintain security checks in CI/CD pipelines (SAST, DAST, SCA, secrets scanning).
• Support security reviews of AI/LLM-enabled applications where applicable.
• Identify AI-specific risks such as prompts, data handling, and access controls.
• Investigate findings, assess priority, and track remediation.
• Document findings, security requirements, and recommendations.
• Collaborate with software engineers and security colleagues.
• Keep up to date with security threats and defensive practices.

Skills

Application security

Web security

CI/CD security

Python scripting

Communication

Analytical mindset

Team collaboration

Secure coding

Education

Bachelor’s or Master’s degree in Computer Science

Tools

SAST

DAST

Software Composition Analysis (SCA)

Vulnerability scanners

Secrets-scanning tools

Job description

Booking.com is seeking an Application Security Engineer to help safeguard our global platform. You will build and operate security tooling, automate remediation, and partner with product teams to embed security within the software lifecycle.

You will review designs, perform secure reviews, and contribute to threat modelling, with emphasis on SAST/DAST and secure AI/LLM integrations. Hybrid work in Amsterdam is offered.