# Booking Holdings Romania - Cybersecurity Incident Responder at Booking.com

Booking.com is hiring a Booking Holdings Romania - Cybersecurity Incident Responder for a remote role open to applicants in Romania. Level rates it Little AI ●○○○; you can [apply on Booking.com](https://jobsbylevel.com/go/082e02c8-6964-4341-bc7d-6ee170eb74c9?utm_medium=ai-agent).

AI Level 1, AI centrality 0 out of 100. Remote (Bucharest, Romania).

## Details

- Company: [Booking.com](https://jobsbylevel.com/companies/booking-com)
- AI level: AI Level 1 (score 0 out of 100)
- Location: Remote (Bucharest, Romania)
- Posted: November 4, 2026
- Apply: https://jobsbylevel.com/go/082e02c8-6964-4341-bc7d-6ee170eb74c9?utm_medium=ai-agent
- Free CV review for this job: https://jobsbylevel.com/cv-review?job=booking-holdings-romania-cybersecurity-incident-responder-at-booking-com-67059b

## Prepare for this job

The job page lists 5 likely interview questions for this offer, with a CV checklist: https://jobsbylevel.com/jobs/booking-holdings-romania-cybersecurity-incident-responder-at-booking-com-67059b

## Description

Booking Holdings Romania is a Center of Excellence based in Bucharest, Romania and was created to support the increasing business demands of the Booking Holdings Brands. The Center of Excellence provides access to specialized and highly skilled talent, leading industry best practices, and collaboration opportunities across all of our Brands. As part of our Booking Holdings Romania team, you will have the opportunity to be a part of the world’s leading provider of online travel, with a mission of making it easier for everyone to experience the world through five primary consumer-facing brands: Booking.com, Priceline, Agoda, KAYAK and OpenTable. Role description The Cyber Security Incident Responder is a key player in providing detection, investigation and response to cyber security attacks and threats such as ransomware, spear-phishing, cloud-based attacks, and Advanced Persistent Threats (APTs). This highly specialized technical subject matter expert position focuses on investigating threats and alerts within large-scale cross-platform environments, performing threat hunting and digital forensics in order to identify intrusions and effectively respond to mitigate security threats on the business. This role provides a hybrid way of working with an onsite presence of 2 days/week. Key Job Responsibilities and Duties Responsible for investigating the incidents escalated by the 24/7 Triage & Monitoring team. Assists the 24/7 Triage & Monitoring team with in-depth investigating cybersecurity alerts raised by a wide variety of security tools like: SOAR, EDR, XDR, IPS/IDS, SIEM, Sandbox, Cloud Security, Email Security, GitLab Security, Container Security. Coordinates incident, response, escalation, and reporting of cybersecurity incidents. Performs technical investigation on complex security incidents to achieve efficient mitigation for active threats and identification of the root cause. Develop and execute hypothesis-driven hunts mapped to MITRE ATT&CK, validate detection coverage through adversary emulation (e.g., BAS platforms), and automate intake, triage, and reporting to maintain a defensible, auditable record of threat evaluation. Collaborates on various departmental projects that help the organization improve its cyber security posture and achieve its mission/objectives. Collaborates with different CDR stakeholders and vendors to remediate any identified gaps. Define and use CSIRT’s playbooks, runbooks, workflows, operational documentation, and processes. Contributes to the writing and maintenance of all such documents. Looks for opportunities to improve documentation and standardization of CSIRT processes. Owns and delivers on assigned projects (often around improvements to detections, processes and playbooks) while balancing execution and deliveries with operations and IR workload; Supports other team members in projects. Drives continuous improvements of our detection and response capabilities quality and efficiency by identifying and owning improvement areas in the technology, methods, processes (including opportunities around detection tuning and automation). Works on shifts covering 16/5 (Monday to Friday, 7 AM - 10 PM). Offers on-call support during the nights, weekends, and public holidays. Role Qualifications and Requirements This role requires technology subject matter expertise in performing hands-on technical incident response, in-depth technical investigations, and Threat Hunting. It is an individual who reads logs, collects technical evidence, and puts together the full picture. The ideal candidate is well plugged into the world of hacking and defense and adversary techniques, all with a hands-on keyboard perspective. 5+ years of operational security experience (SOC, Incident Response, Malware Analysis, etc.). Bachelor's Degree OR equivalent experience and relevant certification (such as CompTIA Security+, Network+, CySA+, CCNA, CCNA CyberOps, GCIH, GCFR, GEIR, GCIA, GCFA, GCFE, GSEC, GCED, GREM, OSCP, OSCE,

The description is cut here. Read the full offer: https://jobsbylevel.com/jobs/booking-holdings-romania-cybersecurity-incident-responder-at-booking-com-67059b

Source: https://jobsbylevel.com/jobs/booking-holdings-romania-cybersecurity-incident-responder-at-booking-com-67059b

## Cite this page

Level. https://jobsbylevel.com/jobs/booking-holdings-romania-cybersecurity-incident-responder-at-booking-com-67059b.

Get job alerts: https://jobsbylevel.com/newsletter