Risk & Compliance Manager

Booking.com; Amsterdam; On-site; EUR 90,000 - 125,000; Full time

Benefits offered by this job

Relocation support

29 vacation days

Booking deals and product discounts

Health and life insurance

Job summary

Booking.com is seeking a Risk Manager for Platform Risk in Amsterdam to lead a team focused on identifying technology-related risks across core DevOps platforms. You will embed secure software development practices and collaborate with senior technical stakeholders to ensure IT controls and regulatory compliance are met.

The role requires strong communication, leadership, and a deep understanding of cloud and on-premises DevOps environments.

Qualifications

• Strong risk and control background with operational/technology risk
• Experience with ITGCs in fast-paced DevOps environments
• Understanding of technology risk management, controls, and compliance (public cloud)
• Familiarity with regulations (SOX, PCI-DSS, GDPR, CCPA)
• Knowledge of cyber security frameworks (NIST, ISO27001, CIS)
• Able to build relationships with business partners to drive risk culture

Responsibilities

• Attract, engage, develop, and retain talent within Platform Risk
• Coach team on Booking values and risk leadership
• Drive cross-functional initiatives with senior stakeholders
• Formulate tactical plans aligned with Central Tech objectives
• Advise stakeholders on IT risk and control design
• Promote risk awareness and embed IT controls across the business
• Collaborate with risk and audit teams for technical perspective
• Stay updated on emerging cyber threats in DevOps environments

Skills

IT risk management

DevOps risk

Cybersecurity

Regulatory compliance

Stakeholder management

Cloud platforms

Communication skills

Leadership

Education

Bachelor/Master

Tools

AWS

GCP

Azure

Kubernetes

CI/CD tools

Job description

The Risk Manager - Platform Risk reports to the Senior Manager of Risk Management and IT Compliance team within Tech Risk Operations (TRO). This is a first-line of defense risk team responsible for Central Tech business unit risks & Security risks across the company. The Risk Manager - Platform Risk is a people manager role, focused on leading a team of individuals to enable consistent identification of technology-related risks for key Central Tech business unit technology platforms. These technology platforms enable the business to build and run in-house developed applications that support the core of our Business.

The Risk Manager - Platform Risk possesses both a strong technical understanding of DevOps IT technology and expertise in various risk domains. These domains include cybersecurity, IT, privacy, regulatory compliance, broader enterprise risks, Trust & Safety, cybersecurity regulatory compliance, and e-commerce fraud. This role involves identifying technology-related risks across core DevOps technology platforms, encompassing both public cloud and on-premise infrastructure. This includes public and private cloud platforms such as AWS, GCP, Azure, Kubernetes, Gitlab, and CI/CD toolings.

This role also requires embedding secure software development principles and tooling (SAST, DAST, SCA) into BAU development practices, to apply them effectively to DevOps technology platforms. The Risk Manager - Platform Risk is also a subject matter expert leveraging a deep understanding of the enterprise risk discipline combining theory and organizational practice. Effective first-line risk professionals are adaptable individuals who can engage with diverse senior technical stakeholders, and require strong communication skills, technical proficiency, and the ability to foster collaboration and steer efforts toward positive business results in managing IT risks and ensuring IT regulatory compliance obligations are met.

This role requires engaging with senior stakeholders to identify appropriate risk responses, and supporting and maintaining a fit-for-purpose IT controls framework, including the development of additional IT controls to manage risks. It requires a demonstration of simplifying and automating complex processes to manage risks in line with our risk appetite. It requires strong stakeholder management skills to convince others who are skeptical or unwilling to accept new concepts, practices and approaches. The position involves extensive collaboration with senior technical stakeholders to maintain existing IT controls across the organization, build strong relationships, communicate complex information, and influence individuals and teams even when faced with resistance. The ability to navigate organizational complexities and foster a culture of IT risk management, security awareness and compliance is critical. This role is also a people manager position and is fully responsible for managing a team of individuals and continuously improving the area under their scope.

Key Responsibilities And Duties

• Attract, engage, develop, and retain talent to their full potential by fostering a supportive work environment that emphasizes continuous feedback, coaching, and mentorship programs.
• Coach your team on and consistently role model the Booking values on Think Customer First, Own It, Learn Forever, Succeed Together, and Do the Right Thing.
• Drive initiatives effectively involving multiple technical first-line senior stakeholders, re-prioritising tasks when beneficial.
• Formulate and implement tactical plans and objectives within Platform Risk Management that are in alignment with Central Tech business objectives and ensure the achievement of annual goals. Establish team priorities, delegate projects, allocate resources, and provide regular communication to management and business partners regarding business performance and project progress.
• Advise first-line stakeholders with specialized knowledge and expertise in IT risk, cybersecurity and regulatory compliance risk. Assume responsibility for the identification of technological risks and the formulation of control design proposals. Offer guidance on control design that is sustainable and appropriately scaled, ensuring that solutions are commensurate with the complexity of the issues addressed and avoiding unnecessary overengineering.
• Drive business engagement in the Central Tech business unit to provide risk and compliance awareness for teams that have a clear need to manage risks without significantly affecting their development velocity and/or play a key role towards achieving strategic objectives in the company.
• Develop and maintain IT and security policies and procedures for secure software development & collaborate with development teams to integrate secure software development practices and principles into CI/CD pipelines.
• Support senior stakeholders across central tech helping to promote and embed risk and compliance ownership across the business as well as to broaden and expand their knowledge base of both the internal and external risk environment.
• Follow broader ERM strategy defined by R&C and implement it into execution within the first-line of defense (business) and drive continuous improvement of risk assessment methodologies through ongoing collaboration with second-line risk and controls teams, ensuring alignment with practical business objectives.
• Support the team to identify ways to increase their business impact and improve the team’s product(s) and ways of working.
• Liaise with other risk and audit teams (Risk and Controls, Internal Audit, external auditors, etc.) to provide a more in-depth technical risk perspective, as needed.
• Stay current with emerging cyber threats and security best practices in DevOps environments.

Knowledge And Skills

• Requirements of special knowledge/skills:
• Strong risk and control or audit/assurance background with a deep understanding of operational and technology risk - L4
• Strong working experience with IT General Controls (ITGCs), especially in fast-paced DevOps environments
• Strong understanding of technology risk management, controls, and compliance, especially for public cloud platforms and DevOps Tooling - L4
• Experience and understanding of applicable regulations such as Sarbanes Oxley, PCI-DSS, GDPR and CCPA - L4
• Familiarity with industry-standard Cybersecurity regulatory frameworks such as NIST, ISO27001 and CIS - L3
• Understanding of cybersecurity risks and data protection principles - L3
• Technical AWS certifications (AWS Certified Solutions Architect, AWS Certified Security) are a plus
• Knowledge of secure software development practices and tooling (SAST, DAST, and SCA tools)
• Ability to cultivate solid relationships with business partners in order to drive the adoption of the risk management culture
• Thorough technical understanding of internal control requirements and design and experience in applying them in various businesses
• Able to split large tasks into logical, manageable and decoupled actions which are managed effectively and delivered on time
• Be flexible and agile in response to the change in business, change in stakeholder expectations and/or change in regulatory/operating environment of B.com
• Level of Education: Bachelor/Master
• Years of relevant Job Knowledge: Extensive Knowledge (8 - 12 years)

Benefits & Perks: Global Impact, Personal Relevance

• Headquarters located in one of the most dynamic and cosmopolitan cities in Europe: Amsterdam.
• Contribute to a high‑scale, sophisticated, world‑class product and see the real‑time impact of your work on millions of travelers worldwide.
• Be part of a truly international fast‑paced environment and performance‑driven culture.
• Full relocation support for you and your family to move to Amsterdam.
• Performance‑based company that offers 29 vacation days, career advancement, and lucrative compensation, including bonuses and stock potential.
• Discount on Booking.com accommodations with the “Booking Deal” including other perks and benefits.
• Company‑sponsored family and social activities to help our employees become integrated with each other and Dutch culture.
• Diverse and creative colleagues from every corner of the world.
• Health, life, and disability insurance*.
• Annual paid time off and generous paid leave scheme including parent, grandparent, bereavement, and care leave.
• Hybrid working including flexible working arrangements, and up to 20 days per year working from abroad (home country).
• Industry‑leading product discounts for yourself, friends, and family, including automatic Genius Level 3 status and quarterly Booking.com wallet credit.
• Free access to online learning platforms, development and mentorship programs, and a complimentary Headspace membership.
• On‑site meals, coffee, and snacks, including healthy and vegan options, daily*.
• Benefits may vary slightly depending on location and contract type.

Booking.com is proud to be an equal opportunity workplace and is an affirmative action employer.

If your application is successful, your personal data may be used for a pre‑employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre‑employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.