Risk and Compliance Officer

Booking.com; Amsterdam; On-site; EUR 90,000 - 150,000; Full time

Benefits offered by this job

Health insurance

Headspace access

Pension plan

Annual paid time off

Parental leave 22 weeks

WFH support

Job summary

Booking.com is seeking a DMLP 1st Line Risk & Compliance Officer to coordinate risk, audit and compliance for data and machine learning systems including Kafka, Flink, BDX, MySQL, and AI/ML platforms. You will partner with platform and data teams, ensuring ownership, controls, and documentation are aligned with PCI-DSS, NIST, and SOX requirements.

The role emphasizes risk assessment, control design, and proactive remediation, with strong collaboration across engineering and risk teams to

Qualifications

• Experience in IT risk, audit, controls in data/AI environments.
• Knowledge of governance, risk, and IT control frameworks (SOX, PCI-DSS).
• Ability to translate technical risk into business language.

Responsibilities

• Act as 1st line risk partner to DML platform owners and data teams, advising on risk exposure and regulatory requirements.
• Lead discovery reviews and risk assessments across data and AI/ML systems, identifying gaps and driving remediation.
• Maintain R&R documentation for ITGC controls with named 1st line owners and defensible rationales.
• Coordinate platform compliance controls and audit follow-ups, tracking remediation to closure.
• Maintain DML risk inventory and report risk coverage, issues, and remediation status using JIRA and ServiceNow.
• Provide right-sized controls design that is practical and scalable across the platform.
• Build relationships with senior stakeholders across engineering, platform, and audit teams.
• Identify opportunities to automate compliance and reporting bottlenecks.

Skills

IT risk

Audit

SOX compliance

PCI-DSS knowledge

Risk assessment

Governance

Documentation

Stakeholder management

Cloud (AWS)

Data and ML platforms knowledge

Education

CRISC certification

CISA certification

Tools

JIRA

ServiceNow

Job description

• The DMLP 1st Line Risk & Compliance Officer owns the day-to-day coordination of risk, audit, and compliance activities for Booking.com’s data and machine learning systems including Kafka, Flink, BDX, MySQL, and AI/ML platforms. This role establishes clear ownership, processes, and documentation across the DML risk landscape, acting as the primary risk partner to platform and service owners in this domain
• Risk & Compliance Partnership: Act as the 1st line risk partner to DML platform owners and data teams (Kafka, Flink, BDX, MySQL, AI/ML systems), advising on risk exposure and tailoring PCI-DSS, NIST, SOX, and any other regulatory compliance requirements to data and ML environments
• Discovery & Risk Assessments: Lead discovery reviews and risk assessments across data and AI/ML systems, identifying gaps in ownership, controls, and documentation, and driving remediation with the relevant control owners
• Control Ownership & R&R Clarity: Maintain clear roles and responsibilities (R&R) documentation for DML ITGCs (e.g., BDX DMA), ensuring every control has a named 1st line owner and a defensible rationale grounded in official documentation
• Audit & Compliance Follow-Up: Coordinate and lead platform compliance controls and audit follow-ups and matters, tracking remediation actions to closure and liaising with 2nd line/audit stakeholders
• Risk Register & Reporting: Maintain the DML risk inventory, report on risk coverage, issues, and remediation status through tools such as JIRA and ServiceNow
• Right-Sized Control Design: Provide advice on control design that is sustainable and right‑sized simple solutions for simple problems, avoiding overengineering while keeping controls effective
• Stakeholder Coordination & TRO representation: Establish relationships with senior stakeholders. Build and maintain robust relationships across engineering, platform ownership, and risk/audit teams to keep ownership, processes, and documentation aligned as the DML platform evolves
• Continuous Improvement: Identify opportunities to automate manual compliance and reporting bottlenecks, and refine risk assessment methodology to keep pace with a fast-moving data/AI environment
• Success Looks Like:
• Sustainable Control Landscape: Every DML control (including Kafka, Flink, BDX, MySQL, and AI/ML) has a clear, documented, and accountable 1st‑line owner. Controls are perceived as “right‑sized” and integrated into the workflow rather than added hurdles
• Audit & SOX Readiness: Audit follow‑ups, remediation actions, and SOX‑related compliance matters are tracked proactively and driven to closure on time, with no major surprises during review cycles
• Proactive Risk Stewardship: Risk assessments for new data and AI initiatives are embedded before major architectural decisions are locked in, ensuring the platform scales securely by design
• Trusted Strategic Partner: Your team is seen by engineering leadership not as a blocker, but as a critical partner in delivery. You are effectively navigating “shared goal” trade‑offs, leaving stakeholders with clarity, respect, and a clear, workable path forward

Benefits

• Health insurance
• Free access to Headspace for you and your loved ones
• Global Employee Assistance Program
• Meditation and Breastfeeding rooms at the office
• Booking Cares - 2 days per year to volunteer and learn
• Life insurance
• Disability insurance
• Pension plan
• Annual paid time off
• Parental leave - 22 weeks
• Grandparent leave - 10 days
• Care leave - 10 days
• Bereavement leave - up to 4 weeks
• Anniversary leave
• Working from Home Furniture and Ergonomic Support
• Working from Abroad - up to 20 days per year
• Discounts & Wallet credits to spend on our products
• Upgrade to Booking.com Genius Level 3
• Friends & Family Booking.com discount vouchers
• Free access to online learning platforms
• Development and mentorship programs to support career growth
• Access to trainings and workshops
• Team development opportunities
• Local discount programs
• Game rooms in offices
• On‑site meals, coffee and snacks including vegan options

Certifications: CRISC (or actively working toward it) is preferred; the domains of Governance, IT Risk Assessment, Risk Response & Reporting, and Information Technology & Security map directly onto this role’s daily work. CISA or equivalent is a plusSystemic Problem Solving: A track record of moving beyond individual ticket‑based risk management to designing scalable operating models. You can identify patterns, define reusable guardrails, and build “one coherent model” for risk that evolves alongside the platformPlatform Risk & Cloud Fluency: Broad job knowledge (typically 5–8 years) in IT risk, audit, or controls, with hands‑on exposure to cloud environments (AWS preferred) and the ability to translate data platform and streaming architecture Kafka, Flink, BDX, MySQL, AI/ML pipelines into concrete risk assessments and control requirementsStructured Problem Solving: Able to work from individual findings toward reusable patterns, flagging when a local issue looks systemic so the wider team can decide on a shared guardrailPlatform Risk & Cloud Expertise: Deep expertise in platform risk and compliance, with hands‑on experience in cloud environments (AWS or cloud expertise preferred). You understand how to translate technical architecture, specifically data platforms, streaming infrastructure, and AI/ML systems into tangible risk assessmentsComfortable coordinating across many stakeholders with minimal day‑to‑day supervision, in a fast‑changing, sometimes ambiguous environmentStrategic Leadership & Confidence: Demonstrated ability to lead risk strategy with confidence and conviction. You are comfortable challenging senior stakeholders, independently steering complex decisions, and maintaining clarity in ambiguous environments without softening the core messageStrong documentation and communication skills and able to translate technical risk into clear, concise, business‑friendly languageControl Framework Depth: Practical, applied knowledge of SOX and PCI‑DSS, with the judgment to right‑size controls so they stay effective and audit‑ready without adding unnecessary friction for engineering teamsControl Framework Mastery: Strong practical knowledge of SOx and AWS. You don’t just know the frameworks, you know how to “right‑size” controls so they are effective, scalable, and audit‑ready without creating unnecessary friction for engineering teamsClear Communicator: Can translate technical risk into plain language for engineering, platform, and audit stakeholders, and hold a respectful but firm line in day‑to‑day discussionsAudit Support Experience: Comfortable preparing evidence, coordinating walkthroughs, and drafting remediation memos for internal/external audit and SOX cyclesCross‑Functional Influence: Exceptional ability to translate technical risk into business‑friendly language for diverse stakeholders. You build robust partnerships across engineering, platform, and audit teams, acting as a go‑to partner who enables velocity while ensuring complianceFamiliarity with GenAI/AI governance risk concepts is a plus but not essential