> Markdown version of [/jobs/ext/363103-senior-security-architect](https://www.wearedevelopers.com/jobs/ext/363103-senior-security-architect). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Security Architect

- **Company:** Booking.com
- **Location:** Amsterdam, Netherlands
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Access, Cloud Computing Security, Cyber Security, Identity and Access Management, Information Systems Security Architecture Professional, Network Security, Systems Development Life Cycle, Zero Trust Network Access, Software Engineering, Software Security
- **Published:** June 21, 2026
- **Apply:** https://nl.indeed.com/viewjob?jk=91bbbfe4922b9854

## About the Role

Do you have experience in Security?, * Significant experience in technology, with strong experience in security architecture at enterprise scale.

 * Deep understanding of enterprise security domains, including identity and access management, data protection, network security, application security, infrastructure security, and cloud security.
 * Proven ability to design security architecture that works in large, distributed engineering organisations.
 * Experience shaping security non-functional requirements, architectural guidance, reference patterns, and technical guidance.
 * Strong understanding of zero-trust principles and how to apply them pragmatically in complex technology environments.
 * Experience with security regulations, audit expectations, and risk management, with the judgment to turn requirements into scalable engineering practices.
 * Strong understanding of software delivery, developer workflows, and how security can be embedded into the SDLC without creating unnecessary manual gates.
 * Credibility with senior engineers, architects, security specialists, and SRE teams, with the ability to influence without direct authority.
 * Clear communicator who can explain complex security topics in practical terms for technical and non-technical audiences.
 * Pragmatic judgment, with the ability to focus on the biggest risks and avoid chasing theoretical consistency everywhere.
 * Relevant security certifications, such as CISSP-ISSAP, GDSA, CCZT, CISM, or cloud security certifications, are helpful but not required.

## Description

The Senior Security Architect exists to make it easier for engineers to build secure, resilient systems without slowing delivery down. Reporting to the Director of Architecture, the role leads the security architecture domain within Tech Standards.

Tech Standards is the central architecture capability that turns Booking.com's enterprise architecture direction into practical principles, guidance, sensible defaults, and reusable patterns. Its purpose is to reduce cognitive load for engineering teams, make good technical choices easier to apply, and help Business Units move faster with confidence.

The role works closely with Security, SRE, Business Unit architects, and engineering teams to ensure security expectations are clear, actionable, and embedded into how software is designed, built, and run. It is not a gatekeeper role. It is an enablement role, focused on making secure engineering the default path.

A core part of the role is helping define the security non-functional requirements that form part of Booking.com's architecture guidance, in close partnership with the Security organisation. Success depends on combining deep security architecture expertise with the ability to influence senior technical communities, make trade-offs clear, and help teams adopt better security practices in real delivery work., * Own the security architecture domain within Tech Standards, aligned with the Director of Architecture's enterprise architecture direction.

 * Translate Booking.com's Tech Guiding Principles into practical security architecture guidance, patterns, and defaults that reduce friction for engineering teams.
 * Work with the Security organisation to shape security non-functional requirements that are clear, practical, and usable by engineering teams.
 * Turn security requirements, policies, and audit findings into architecture guidance and reference patterns that teams can apply without unnecessary manual gates.
 * Partner with Business Unit architects, engineering leaders, Security, and SRE to make security guidance relevant to real delivery needs.
 * Provide a strategic enterprise view of security architecture across identity, access, data protection, network security, application security, resilience, infrastructure, and cloud security.
 * Champion shift-left security by embedding security thinking into the software development lifecycle and product delivery lifecycle.
 * Define practical patterns for zero-trust architecture and help teams adopt them in ways that fit Booking.com's technology estate.
 * Help teams understand the trade-offs between security, delivery speed, resilience, complexity, and operational cost.
 * Coach and mentor architects and engineering communities so security architecture becomes easier to understand and apply.


## Related Videos

- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Blazing Accessibility Basics](https://www.wearedevelopers.com/videos/568-blazing-accessibility-basics)
- [Small, Secure, Interconnected: The next Internet Protocol](https://www.wearedevelopers.com/videos/100062-small-secure-interconnected-the-next-internet-protocol)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [Enabling automated 1-click customer deployments with built-in quality and security](https://www.wearedevelopers.com/videos/83-enabling-automated-1-click-customer-deployments-with-built-in-quality-and-security)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [How to land a developer job in Amsterdam](https://www.wearedevelopers.com/magazine/36-how-to-land-a-developer-job-in-amsterdam)
- [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers)
- [Software Developer Salary in The Netherlands [2023]](https://www.wearedevelopers.com/magazine/217-software-developer-salary-in-the-netherlands-2023)
- [How to Find Tech Jobs in Amsterdam](https://www.wearedevelopers.com/magazine/279-how-to-find-tech-jobs-in-amsterdam)
- [Best Companies in the Netherlands: Top 25 Companies in 2023 ](https://www.wearedevelopers.com/magazine/193-best-companies-in-the-netherlands-top-25-companies-in-2023)