Risk Officer

Booking.com; Amsterdam; Hybrid; EUR 90,000 - 150,000; Full time

Benefits offered by this job

Annual time off

Hybrid work up to 20 days abroad

Booking.com product discounts

Job summary

Booking.com is seeking a Risk Officer to join the Marketing, Strategic Partnership Risk Partner team. You will lead internal control design, SOX alignment and risk governance across business and IT, partnering with 2nd line risk and operational teams to strengthen controls and reporting.

The role requires 6+ years in controls or risk, strong knowledge of COSO/COBIT/NIST/ISO 27001, and comfort with cloud and DevOps environments. This hybrid role offers global impact and a path to leadership.

Qualifications

• 6+ years of experience in internal controls, audit, risk management or compliance.
• Bachelor's degree or higher (Master’s preferred).
• Strong knowledge of COSO, COBIT, NIST, ISO 27001 and regulatory requirements (SOX, GDPR, DMA, DSA).
• Certifications such as CISM, CRISC, ACCA, CIA, CISA are advantageous.
• Experience with Data Governance, Cloud, SaaS, BCM; AI/ML and RPA are a plus.
• Comfortable with DevOps and cloud environments (Kubernetes, GitLab, Terraform; AWS, GCP).
• Excellent stakeholder management and communication; proactive in dynamic settings.

Responsibilities

• Design, implement and maintain internal control frameworks aligned with regs and standards.
• Collaborate with 2nd line risk partners, process owners, control owners and management.
• Maintain central repository of policies, procedures and control matrices.
• Develop RACI and training materials; enable ongoing control improvements.
• Provide SOx guidance and SME support to stakeholders and remediation efforts.
• Support audit planning, issue management and testing of controls.
• Partner to enhance GRC platform and risk reporting; promote risk culture.

Education

Bachelor's degree

Master's degree preferable

Tools

Kubernetes

GitLab

Terraform

AWS

GCP

Job description

About Us:

At Booking.com, data drives our decisions. Technology is at our core. And innovation is everywhere. But our company is more than datasets, lines of code or A/B tests. We’re the thrill of the first night in a new place. The excitement of the next morning. The friends you encounter. The journeys you take. The sights you see. And the memories you make. Through our products, partners and people, we make it easier for everyone to experience the world.

Role Overview

We are looking for a Risk Officer to join our Marketing, Strategic Partnership Business Unit (SP) Risk Partner team, which operates as the first line of defense at Booking.com.

This role is responsible for supporting the business in managing and mitigating both business and information technology risks through partnering with the business as a risk subject matter expert, and the implementation of a robust Risk Management Process and Internal Control Framework.

As a Risk Officer in SP, the primary focus is to ensure that our business processes and IT systems operate effectively, comply with internal policies and external regulations, and that risks are identified, assessed, and managed proactively. This position requires a professional who can bridge the gap between operational business requirements and technical IT controls.

Key Job Responsibilities and Duties

• Internal Control framework design and implementation:
  • Develop, implement, and maintain internal control frameworks aligned with industry best practices and applicable regulatory requirements (e.g.,SOX, COSO, COBIT, NIST, ISO 27001, other compliance frameworks)
  • Collaborate with 2nd line Risk partners, process owners, control owners and management to ensure the frameworks are practical, effective and tailored to business needs
  • Maintain a central repository of policies, procedures, control matrices
  • Develop RACI and standardized approach for implementation including training and communication
  • Develop approach for ongoing review & continuous improvement
  • Enable business partners with guidelines, templates and tooling
  • Maintain a central register of all framework documents
  • Contribute to risk and control reporting and assurance in the business unit
• Act as SOx design authority:
  • Partner with R&C and SP business and IT stakeholders by providing guidance and ensuring that critical SOx controls are adequately designed and documented, in order to strengthen the control environment, mitigate the company risks and support the business in achieving objectives
  • Provide SME guidance to R&C and SP business and IT stakeholders and 1st line business owners in relation to observations and deficiencies, from initial assessment/triage through to mitigation and remediation
• Support Audit management - act as an SME to support critical audit management activities such as audit planning and issue management
• Support testing of business and IT controls and management certification (SOX Section 302 and 404, other compliance frameworks) by providing guidance to the testing team and reviewing the testing documentation.
• Collaborate with GRC team and 1st/2nd line Risk partners to develop solutions and improve how risks, controls and issues are maintained in our GRC platform
• Act as a risk ambassador within Booking.com to further enhance risk awareness and culture, including by facilitating formal training sessions

Role Qualifications And Requirements

• 6+ years of previous work experience in internal controls, audit, risk management, or compliance
• Bachelor's degree or higher in a relevant field (Master’s Degree is preferable).
• Strong knowledge of internal control frameworks (e.g., COSO, COBIT, NIST, ISO 27001) and regulatory requirements (e.g., SOX, GDPR, DMA, DSA), and experience in applying them in various business areas/functions
• Qualifications related to any of the above are advantageous (incl. CISM, CRISC, ACCA, CIA, CISA)
• Experience with Data Governance, Cloud platforms, SaaS applications, business continuity management, and emerging technologies (AI/ML, RPA) is a plus
• Comfortable with modern tech environments such as Devops (Kubernetes, Gitlab, terraform etc.) and also cloud based (AWS, GCP etc.)
• Good stakeholder management skills
• Flexibility to adapt to an ever-evolving and dynamic work environment
• Self-starter with strong sense of responsibility
• Energetic and very proactive
• Process, problem solving and action oriented mindset
• Strong communication and relationship building skills
• High level of integrity, confidentiality & professionalism
• Ability to develop strong relationships with business partners in order to drive risk management culture and implementation
• Fluent in English, both written and spoken (other languages would be a plus)
• Project management skills a plus

Benefits & Perks - Global Impact, Personal Relevance

• Annual paid time off and generous paid leave scheme including: parent, grandparent, bereavement, and care leave
• Hybrid working including flexible working arrangements, and up to 20 days per year working from abroad (home country)
• Industry leading product discounts - up to 1400 per year - for yourself, including automatic Genius Level 3 status and Booking.com wallet credit

Inclusion at Booking.com

Inclusion has been a core part of our company culture since day one. This ongoing journey starts with our very own employees, who represent over 140 nationalities and a wide range of ethnic and social backgrounds, genders and sexual orientations.

Take it from our Chief People Officer, Paulo Pisano: “At Booking.com, the diversity of our people doesn’t just build an outstanding workplace, it also creates a better and more inclusive travel experience for everyone. Inclusion is at the heart of everything we do. It’s a place where you can make your mark and have a real impact in travel and tech.”

We ensure that colleagues with disabilities are provided the adjustments and tools they need to participate in the job application and interview process, to perform crucial job functions, and to receive other benefits and privileges of employment.

Booking.com is proud to be an equal opportunity workplace and is an affirmative action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. We strive to move well beyond traditional equal opportunity and work to create an environment that allows everyone to thrive

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.