Application Security Engineer

• Build and maintain application protections. Implement, operate and improve WAF policies for internet-facing applications and APIs, including managed rule configuration, custom rules, rate limits and exceptions. Make changes through CDK and CI/CD, with appropriate review, validation, rollout monitoring and rollback plans.
• Make prevention practical. Assess how application-layer threats and observed attack patterns should be addressed at the edge. Tune controls to reduce exposure while managing false positives and service impact; work with service owners to validate changes and explain their effect.
• Improve detection and visibility. Use WAF, SIEM and relevant application or cloud telemetry to identify gaps in coverage. Create or tune detection logic, queries, alert context and investigation playbooks so that suspicious activity can be assessed quickly and consistently.
• Investigate and respond. Provide third-line technical escalation for application-facing security incidents. Triage escalated alerts, establish what happened and which services or users may be affected, preserve relevant evidence, and coordinate containment or mitigation with incident leads and service owners.
• Improve controls from incidents. Document findings and recommendations, identify recurring patterns, and recommend proportionate improvements to WAF policy, detections, logging, runbooks or automation. Implement assigned changes and track the actions you own to completion, coordinating with relevant owners when needed.
• Automate routine work. Write and maintain scripts or small tools that improve the safety, repeatability and efficiency of security operations, WAF changes, alert investigation and response workflows.
• Collaborate on scoped work. Most work is owned within Security Engineering. Coordinate with application, platform, security operations and incident response partners to implement agreed WAF or detection changes and investigate escalations. Share findings, promote relevant security practices and raise broader trade-offs or priorities with senior colleagues.
• Support teammates. Share practical guidance and help junior colleagues handle established WAF, detection and response tasks; bring novel or complex scenarios to senior colleagues.

• Approximately 3-5 years of experience in security engineering, application security, cloud security, detection and response, or a closely related hands-on role; a relevant bachelor’s degree or equivalent practical experience.
• Practical experience designing, operating or tuning web application firewall controls. AWS WAF experience is strongly preferred.
• Experience managing security configuration through code and delivery pipelines, with a working understanding of infrastructure as code and safe change practices. AWS CDK experience is an advantage.
• Ability to investigate web and API activity using SIEM or log analytics tools: formulate queries, correlate events, assess alert quality and explain what the evidence does and does not show.
• Working knowledge of HTTP, web applications and APIs, common application-layer attack patterns, and how edge controls can mitigate them.
• Hands-on scripting or programming skills in Python, TypeScript, JavaScript, or a comparable language, used to automate or support security work.
• Experience participating in security incident investigations, including triage, scoping, evidence gathering, containment coordination and clear documentation.
• Clear communication and sound judgement: able to handle common tasks independently within team priorities, collaborate with partners on defined work, and seek support when a situation is unusual, complex or has broader impact., * Experience with AWS security and logging services, WAF log analysis, or cloud-native application environments.
• Familiarity with SIEM detection engineering, alert tuning, incident playbooks, or security automation.
• Experience handling WAF false positives, application availability concerns, or coordination during a live security event.
• Knowledge of OWASP web and API risks, bot or automated abuse patterns, and practical edge mitigation approaches.
• Experience using version control and code review to manage security infrastructure changes.

What success looks like

You deliver reliable, reviewed protection and detection changes within team priorities; investigate escalations with evidence and clear reasoning; and coordinate timely mitigations during incidents. You own common tasks, contribute to improvements selected by the team, and bring complex or exceptional cases to senior colleagues with a concise assessment and recommended next steps.

Booking.com’s Total Rewards Philosophy is not only about compensation but also about benefits. We offer a competitive compensation and benefits package, as well unique-to-Booking.com benefits which include:

• Annual paid time off and generous paid leave scheme including: parent, grandparent, bereavement, and care leave * Hybrid working including flexible working arrangements, and up to 20 days per year working from abroad (home country) * Industry leading product discounts - up to 1400 per year - for yourself, including automatic Genius Level 3 status and Booking.com wallet credit

• Living and working in Amsterdam, one of the most cosmopolitan cities in Europe * Contributing to a high scale, complex, world renowned product and seeing real-time impact of your work on millions of travelers worldwide * Working in a fast-paced and performance driven culture * Opportunity to utilize technical expertise, leadership capabilities and entrepreneurial spirit * Promote and drive impactful and innovative engineering solutions * Technical, behavioral and interpersonal competence advancement via on-the-job opportunities, experimental projects, hackathons, conferences and active community participation * Competitive compensation and benefits package and some great added perks of working in the home city of Booking.com

Diversity, Equity & Inclusion have been a core part of our company culture since day one. This ongoing journey starts with our very own employees, who represent over 140 nationalities and a wide range of ethnic and social backgrounds, genders and sexual orientations.

Take it from our Chief People Officer, Paulo Pisano: “At Booking.com, the diversity of our people doesn’t just build an outstanding workplace, it also creates a better and more inclusive travel experience for everyone. Inclusion is at the heart of everything we do. It’s a place where you can make your mark and have a real impact in travel and tech.”

We ensure that colleagues with disabilities are provided the adjustments and tools they need to participate in the job application and interview process, to perform crucial job functions, and to receive other benefits and privileges of employment.