Security Engineer II

Booking Holdings, Inc.; Amsterdam; Hybrid; EUR 80,000 - 120,000; Full time

Benefits offered by this job

Hybrid working

Annual paid time off

Product discounts

Amsterdam living

Hackathons and events

Job summary

Booking.com is seeking an Application Security Engineer to help safeguard our global platform. You will build and operate security tooling, automate remediation, and partner with product teams to embed security within the software lifecycle.

You will review designs, perform secure reviews, and contribute to threat modelling, with emphasis on SAST/DAST and secure AI/LLM integrations. Hybrid work in Amsterdam is offered.

Qualifications

• Basic to intermediate knowledge of application and web security.
• 3+ years of relevant industry experience.
• Familiarity with risks such as injection, broken access control, authentication failures, security misconfiguration, XSS, insecure dependencies.
• Understanding of OWASP Top 10 and secure coding principles.
• Familiarity with HTTP, APIs, authentication, authorization, and TLS.
• Ability to read and understand code in at least one programming language.
• Basic scripting or automation skills (Python, Bash).
• Some experience with security tools (SAST, DAST, SCA, scanners).
• Basic understanding of securing LLM applications (prompts, inputs/outputs).
• Ability to communicate findings clearly.
• Analytical mindset and willingness to learn.
• Bachelor’s or Master’s degree in CS or related field.

Responsibilities

• Review applications, APIs, and designs to identify basic security risks.
• Support secure code reviews and vulnerability assessments.
• Help teams understand and remediate common web vulnerabilities.
• Contribute to threat modelling and security requirements for new features.
• Help integrate and maintain security checks in CI/CD pipelines (SAST, DAST, SCA, secrets scanning).
• Support security reviews of AI/LLM-enabled applications where applicable.
• Identify AI-specific risks such as prompts, data handling, and access controls.
• Investigate findings, assess priority, and track remediation.
• Document findings, security requirements, and recommendations.
• Collaborate with software engineers and security colleagues.
• Keep up to date with security threats and defensive practices.

Skills

Application security

Web security

CI/CD security

Python scripting

Communication

Analytical mindset

Team collaboration

Secure coding

Education

Bachelor’s or Master’s degree in Computer Science

Tools

SAST

DAST

Software Composition Analysis (SCA)

Vulnerability scanners

Secrets-scanning tools

Job description

About Us:

At Booking.com, data drives our decisions. Technology is at our core. And innovation is everywhere. But our company is more than datasets, lines of code or A/B tests. We’re the thrill of the first night in a new place. The excitement of the next morning. The friends you encounter. The journeys you take. The sights you see. And the memories you make. Through our products, partners and people, we make it easier for everyone to experience the world.

About the team

Booking.com’s Application Security team is responsible for protecting the world’s largest travel platform against attacks targeting our application stack. The team develops and maintains the signals, tools, and infrastructure used to secure Booking.com products and defines secure coding practices for all developers. We work closely with product and engineering teams to ensure customer data remains safe through secure-by-design software architecture.

Role Description:

As an Application Security Engineer, you will play a key role in safeguarding the security and privacy of Booking.com customers. You will build and operate advanced security tooling, automate remediation, analyze security indicators, and partner with product teams to embed security throughout the software development lifecycle.

Your expertise will directly contribute to the detection, prevention, and response to application security threats across Booking.com’s global platform.

Key responsibilities

• Review applications, APIs, and designs to identify basic security risks.

• Support secure code reviews and vulnerability assessments.

• Help teams understand and remediate common web vulnerabilities.

• Contribute to threat modelling and security requirements for new features.

• Help integrate and maintain security checks in CI/CD pipelines, such as SAST, DAST, software composition analysis, and secrets scanning.

• Support security reviews of AI- and LLM-enabled applications, where applicable.

• Help identify basic AI-specific risks such as prompt injection, sensitive information disclosure, insecure output handling, excessive agency, model or data poisoning, and unbounded consumption.

• Investigate security findings, assess their priority, and track remediation.

• Support the configuration and use of application security tools.

• Write simple scripts or automation to improve security processes.

• Document findings, security requirements, procedures, and recommendations.

• Work collaboratively with software engineers, platform teams, and security colleagues.

• Keep up to date with common application security threats and defensive practices.

What we are looking for

• Basic to intermediate knowledge of application and web security.

• 3+ years of relevant industry experience

• Familiarity with common risks such as injection, broken access control, authentication failures, security misconfiguration, cross-site scripting, and insecure dependencies.

• Understanding of the OWASP Top 10 and basic secure coding principles.

• Familiarity with HTTP, APIs, authentication, authorization, and TLS.

• Ability to read and understand code in at least one programming language.

• Basic scripting or automation skills in Python, Bash, or a similar language.

• Some experience with application security tools, such as SAST, DAST, software composition analysis, vulnerability scanners, or secrets-scanning tools.

• Basic understanding of how LLM applications work, including prompts, model inputs and outputs, retrieval-augmented generation, and tool or API integrations.

• Basic understanding of how to secure LLM applications through input and output validation, data minimisation, access control, least privilege, rate limiting, logging, and human approval for high-impact actions.

• Ability to communicate security findings clearly and constructively.

• Analytical mindset, attention to detail, and willingness to learn.

• Ability to work effectively with developers and other technical teams.

• Bachelor’s or Master’s degree in Computer Science or a related field.

Nice to have

• Experience with cloud platforms, containers, or infrastructure as code.

• Familiarity with API security or microservices.

• Experience or interest in securing AI or LLM-enabled applications.

• Experience with threat modelling or security testing.

• Familiarity with vulnerability management or incident response.

• Knowledge of privacy or security requirements relevant to software development.

• Security certifications or relevant practical projects.

What success looks like

• You identify and explain common application security risks.

• Development teams receive practical remediation guidance.

• Security checks are applied consistently during software development.

• Findings are documented, prioritised, and followed through to resolution.

• You build deeper application security expertise through hands-on work and continuous learning.

Benefits & Perks - Global Impact, Personal Relevance:

Booking.com’s Total Rewards Philosophy is not only about compensation but also about benefits. We offer a competitive compensation and benefits package, as well unique-to-Booking.com benefits which include:

• Annual paid time off and generous paid leave scheme including: parent, grandparent, bereavement, and care leave

• Hybrid working including flexible working arrangements, and up to 20 days per year working from abroad (home country)

• Industry leading product discounts - up to 1400 per year - for yourself, including automatic Genius Level 3 status and Booking.com wallet credit

• Living and working in Amsterdam, one of the most cosmopolitan cities in Europe

• Contributing to a high scale, complex, world renowned product and seeing real-time impact of your work on millions of travelers worldwide

• Working in a fast-paced and performance driven culture

• Opportunity to utilize technical expertise, leadership capabilities and entrepreneurial spirit

• Promote and drive impactful and innovative engineering solutions

• Technical, behavioral and interpersonal competence advancement via on-the-job opportunities, experimental projects, hackathons, conferences and active community participation

• Competitive compensation and benefits package and some great added perks of working in the home city of Booking.com

Diversity, Equity and Inclusion (DEI) at Booking.com:

Diversity, Equity & Inclusion have been a core part of our company culture since day one. This ongoing journey starts with our very own employees, who represent over 140 nationalities and a wide range of ethnic and social backgrounds, genders and sexual orientations.

Take it from our Chief People Officer, Paulo Pisano: “At Booking.com, the diversity of our people doesn’t just build an outstanding workplace, it also creates a better and more inclusive travel experience for everyone. Inclusion is at the heart of everything we do. It’s a place where you can make your mark and have a real impact in travel and tech.”

We ensure that colleagues with disabilities are provided the adjustments and tools they need to participate in the job application and interview process, to perform crucial job functions, and to receive other benefits and privileges of employment.

Pre-Employment Screening

Booking.com is proud to be an equal opportunity workplace and is an affirmative action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. We strive to move well beyond traditional equal opportunity and work to create an environment that allows everyone to thrive.

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.