Security Engineer II
Booking.com8 hours ago
Amsterdam, NetherlandsMid Level
Responsibilities
- Review applications, APIs, and designs for application and web security risks.
- Support secure code reviews, vulnerability assessments, threat modeling, and security requirements development.
- Help engineering teams understand and remediate common web vulnerabilities.
- Integrate and maintain SAST, DAST, software composition analysis, and secrets-scanning checks in development pipelines.
- Support security reviews of AI- and LLM-enabled applications and identify risks such as prompt injection, sensitive information disclosure, insecure output handling, excessive agency, model or data poisoning, and unbounded consumption.
- Investigate, prioritize, document, and track security findings through remediation.
- Configure and use application security tools and write scripts or automation to improve security processes.
- Collaborate with software engineers, platform teams, and security colleagues while documenting requirements, procedures, and recommendations.
Requirements
- At least 3 years of relevant industry experience.
- Basic to intermediate knowledge of application and web security, including injection, broken access control, authentication failures, security misconfiguration, cross-site scripting, and insecure dependencies.
- Understanding of the OWASP Top 10 and secure coding principles.
- Familiarity with HTTP, APIs, authentication, authorization, and TLS.
- Ability to read and understand code in at least one programming language.
- Basic scripting or automation skills in Python, Bash, or a similar language.
- Experience with application security tools such as SAST, DAST, software composition analysis, vulnerability scanners, or secrets-scanning tools.
- Basic understanding of LLM applications, including prompts, model inputs and outputs, retrieval-augmented generation, and tool or API integrations.
- Understanding of techniques for securing LLM applications, including input and output validation, data minimization, access control, least privilege, rate limiting, logging, and human approval for high-impact actions.
- Bachelor’s or master’s degree in computer science or a related field.
- Preferred qualifications include experience with cloud platforms, containers, infrastructure as code, API security, microservices, threat modeling, security testing, vulnerability management, incident response, privacy or software-development security requirements, security certifications, or relevant practical projects.
Benefits
- Annual paid time off and generous paid leave, including parent, grandparent, bereavement, and care leave.
- Hybrid working with flexible arrangements and up to 20 days per year working from abroad in the home country.
- Product discounts of up to 1400 per year, including Genius Level 3 status and Booking.com wallet credit.
- Opportunity to work in Amsterdam on a large-scale product used by millions of travelers.
- Technical, behavioral, and interpersonal development through on-the-job opportunities, experimental projects, hackathons, conferences, and community participation.
- This role does not come with relocation assistance.
About Booking.com
Booking.com operates a global online travel platform for booking accommodations, flights, car rentals, and experiences for consumers and business travelers. It earns primarily through commissions and merchant/agency models with hotels, vacation rentals, and other travel partners. Founded in 1996 and headquartered in Amsterdam, it is part of Booking Holdings and serves users and suppliers across hundreds of markets worldwide.