# Application Security Engineer at Booking.com

Booking.com is hiring an Application Security Engineer in Amsterdam, Netherlands. Level rates it Little AI ●○○○; you can [apply on Booking.com](https://jobsbylevel.com/go/5a2cf0f2-ed3e-4574-80d9-f5ac0115c7fc?utm_medium=ai-agent).

AI Level 1, AI centrality 30 out of 100. Amsterdam, Netherlands.

## Details

- Company: [Booking.com](https://jobsbylevel.com/companies/booking-com)
- AI level: AI Level 1 (score 30 out of 100)
- Location: Amsterdam, Netherlands
- Posted: October 30, 2026
- Apply: https://jobsbylevel.com/go/5a2cf0f2-ed3e-4574-80d9-f5ac0115c7fc?utm_medium=ai-agent
- Free CV review for this job: https://jobsbylevel.com/cv-review?job=application-security-engineer-at-booking-com-2b4460

## Description

About Us: At Booking.com, data drives our decisions. Technology is at our core. And innovation is everywhere. But our company is more than datasets, lines of code or A/B tests. We’re the thrill of the first night in a new place. The excitement of the next morning. The friends you encounter. The journeys you take. The sights you see. And the memories you make. Through our products, partners and people, we make it easier for everyone to experience the world. About the team : Our security team protects Booking.com’s websites, mobile apps and APIs from attacks and automated abuse. We build and operate security controls, including web application firewalls, bot detection and rate limiting, and use security data to identify and respond to threats. We work with product and engineering teams to improve protection while keeping services reliable and minimising the impact on legitimate customers and partners. Role Description: Help protect customer-facing applications and APIs by engineering runtime security controls, improving application-focused detection, and providing hands-on technical support during security incidents. You will operate WAF protections delivered through infrastructure as code and CI/CD, use SIEM and application telemetry to investigate suspicious activity, and act as a third-line escalation for application security incidents. Your expertise will directly contribute to the detection, prevention, and response to application security threats across Booking.com’s global platform. Key responsibilities Build and maintain application protections. Implement, operate and improve WAF policies for internet-facing applications and APIs, including managed rule configuration, custom rules, rate limits and exceptions. Make changes through CDK and CI/CD, with appropriate review, validation, rollout monitoring and rollback plans. Make prevention practical. Assess how application-layer threats and observed attack patterns should be addressed at the edge. Tune controls to reduce exposure while managing false positives and service impact; work with service owners to validate changes and explain their effect. Improve detection and visibility. Use WAF, SIEM and relevant application or cloud telemetry to identify gaps in coverage. Create or tune detection logic, queries, alert context and investigation playbooks so that suspicious activity can be assessed quickly and consistently. Investigate and respond. Provide third-line technical escalation for application-facing security incidents. Triage escalated alerts, establish what happened and which services or users may be affected, preserve relevant evidence, and coordinate containment or mitigation with incident leads and service owners. Improve controls from incidents. Document findings and recommendations, identify recurring patterns, and recommend proportionate improvements to WAF policy, detections, logging, runbooks or automation. Implement assigned changes and track the actions you own to completion, coordinating with relevant owners when needed. Automate routine work. Write and maintain scripts or small tools that improve the safety, repeatability and efficiency of security operations, WAF changes, alert investigation and response workflows. Collaborate on scoped work. Most work is owned within Security Engineering. Coordinate with application, platform, security operations and incident response partners to implement agreed WAF or detection changes and investigate escalations. Share findings, promote relevant security practices and raise broader trade-offs or priorities with senior colleagues. Support teammates. Share practical guidance and help junior colleagues handle established WAF, detection and response tasks; bring novel or complex scenarios to senior colleagues. What we are looking for Approximately 3–5 years of experience in security engineering, application security, cloud security, detection and response, or a closely related hands-on role; a relevant bachelor’s degree

The description is cut here. Read the full offer: https://jobsbylevel.com/jobs/application-security-engineer-at-booking-com-2b4460

Source: https://jobsbylevel.com/jobs/application-security-engineer-at-booking-com-2b4460

## Cite this page

Level. https://jobsbylevel.com/jobs/application-security-engineer-at-booking-com-2b4460.

Get job alerts: https://jobsbylevel.com/newsletter