> Markdown version of [/jobs/ext/4491666-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4491666-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Booking.com
- **Location:** Amsterdam, Netherlands
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** JavaScript (Programming Language), Application Programming Interfaces (APIs), Amazon Web Services, Application Firewall, Cloud Computing Security, Cloud Engineering, Code Review, Cyber Security, Computer Programming, Hypertext Transfer Protocols (HTTP), Intrusion Detection and Prevention, Python (Programming Language), Log Analysis, Open Web Application Security, Performance Tuning, Security Information and Event Management, TypeScript, Web Applications, AWS Cdk, Data Logging, Delivery Pipeline, Software Security, Software Version Control, Security Orchestration, Automation & Response
- **Published:** November 1, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=9f06d9ed76910947

## About the Role

* Approximately 3-5 years of experience in security engineering, application security, cloud security, detection and response, or a closely related hands-on role; a relevant bachelor's degree or equivalent practical experience.
 * Practical experience designing, operating or tuning web application firewall controls. AWS WAF experience is strongly preferred.
 * Experience managing security configuration through code and delivery pipelines, with a working understanding of infrastructure as code and safe change practices. AWS CDK experience is an advantage.
 * Ability to investigate web and API activity using SIEM or log analytics tools: formulate queries, correlate events, assess alert quality and explain what the evidence does and does not show.
 * Working knowledge of HTTP, web applications and APIs, common application-layer attack patterns, and how edge controls can mitigate them.
 * Hands-on scripting or programming skills in Python, TypeScript, JavaScript, or a comparable language, used to automate or support security work.
 * Experience participating in security incident investigations, including triage, scoping, evidence gathering, containment coordination and clear documentation.
 * Clear communication and sound judgement: able to handle common tasks independently within team priorities, collaborate with partners on defined work, and seek support when a situation is unusual, complex or has broader impact., * Experience with AWS security and logging services, WAF log analysis, or cloud-native application environments.
 * Familiarity with SIEM detection engineering, alert tuning, incident playbooks, or security automation.
 * Experience handling WAF false positives, application availability concerns, or coordination during a live security event.
 * Knowledge of OWASP web and API risks, bot or automated abuse patterns, and practical edge mitigation approaches.
 * Experience using version control and code review to manage security infrastructure changes.

What success looks like

You deliver reliable, reviewed protection and detection changes within team priorities; investigate escalations with evidence and clear reasoning; and coordinate timely mitigations during incidents. You own common tasks, contribute to improvements selected by the team, and bring complex or exceptional cases to senior colleagues with a concise assessment and recommended next steps.

## Description

* Build and maintain application protections. Implement, operate and improve WAF policies for internet-facing applications and APIs, including managed rule configuration, custom rules, rate limits and exceptions. Make changes through CDK and CI/CD, with appropriate review, validation, rollout monitoring and rollback plans.
 * Make prevention practical. Assess how application-layer threats and observed attack patterns should be addressed at the edge. Tune controls to reduce exposure while managing false positives and service impact; work with service owners to validate changes and explain their effect.
 * Improve detection and visibility. Use WAF, SIEM and relevant application or cloud telemetry to identify gaps in coverage. Create or tune detection logic, queries, alert context and investigation playbooks so that suspicious activity can be assessed quickly and consistently.
 * Investigate and respond. Provide third-line technical escalation for application-facing security incidents. Triage escalated alerts, establish what happened and which services or users may be affected, preserve relevant evidence, and coordinate containment or mitigation with incident leads and service owners.
 * Improve controls from incidents. Document findings and recommendations, identify recurring patterns, and recommend proportionate improvements to WAF policy, detections, logging, runbooks or automation. Implement assigned changes and track the actions you own to completion, coordinating with relevant owners when needed.
 * Automate routine work. Write and maintain scripts or small tools that improve the safety, repeatability and efficiency of security operations, WAF changes, alert investigation and response workflows.
 * Collaborate on scoped work. Most work is owned within Security Engineering. Coordinate with application, platform, security operations and incident response partners to implement agreed WAF or detection changes and investigate escalations. Share findings, promote relevant security practices and raise broader trade-offs or priorities with senior colleagues.
 * Support teammates. Share practical guidance and help junior colleagues handle established WAF, detection and response tasks; bring novel or complex scenarios to senior colleagues.