# Proactive Cyber Defence and Engineering at Booking.com

Booking.com is hiring a Proactive Cyber Defence and Engineering in Amsterdam, Netherlands. Level rates it Little AI ●○○○; you can [apply on Booking.com](https://jobsbylevel.com/go/1fcc2026-61d0-4e91-b027-e6601346443d?utm_medium=ai-agent).

AI Level 1, AI centrality 23 out of 100. Amsterdam, Netherlands.

## Details

- Company: [Booking.com](https://jobsbylevel.com/companies/booking-com)
- AI level: AI Level 1 (score 23 out of 100)
- Location: Amsterdam, Netherlands
- Posted: September 14, 2026
- Apply: https://jobsbylevel.com/go/1fcc2026-61d0-4e91-b027-e6601346443d?utm_medium=ai-agent
- Free CV review for this job: https://jobsbylevel.com/cv-review?job=proactive-cyber-defence-and-engineering-at-booking-com-17b994

## Description

Role Overview: This is a leadership role at the heart of a highly mature capability within our Enterprise Security Cyber Defence organisation. If you build threat-informed defence for a living and want to lead exceptional people doing it at scale, read on. This team exists to stay ahead of adversaries, understanding how they operate, closing the gaps that matter before they can be exploited, and engineering scalable, production-grade solutions that make our cyber defence faster and more effective. Threat-informed defence is the heartbeat of this team: study how real adversaries operate, then turn that insight into measurable protection across a large, global technology environment. It's a group of nine specialists across Amsterdam and Bucharest, a mix of senior and core threat researchers and engineers operating as one team across two connected disciplines. On the research side, they turn the world's threat reporting APT and ransomware tradecraft, supply chain attack trends, emerging AI-driven threats into action in our environment: proactive threat hunts, custom detections, custom preventions, and continuously maturing response playbooks. They run adversary emulation and security-control validation week in, week out to prove our defences against real tradecraft then close the gaps they find, themselves and with partner teams. Proactive, not reactive. On the engineering side, they bring detection and response engineering built to a modern industry standard: high-fidelity detection-as-code, telemetry and log-source onboarding, platform and pipeline health, and coverage engineered deliberately against MITRE ATT&CK. They own the full lifecycle not just shipping a detection, but monitoring it, tuning it, managing false positives, and supporting it in production. And they build the automation, SOAR workflows, and AI-driven capabilities that strip out manual toil and make the wider defence organisation faster so skilled people spend their time on the problems that genuinely need human expertise. Everything this team does exists to make detection and response sharper, coverage broader, and investigations faster. Key Job Responsibilities and Duties: Shape strategy in partnership with leadership — translate the broader Cyber Defence strategy into a clear, risk-based plan for the team, set priorities, and own resource assignment and capacity planning so the team works from one aligned plan Expand coverage where it counts most — lead the push for high-value telemetry and detection coverage across our crown jewels, identity, cloud, and the parts of the estate where visibility doesn't exist yet or needs maturity, always knowing where we're strong and where to invest next. Establish detection & response engineering at scale — bring the cutting edge of how the industry does detection engineering into how we do it: detection-as-code, peer review, testing and validation, CI/CD, tuning, and retirement of stale logic — and make sure prototypes become documented, tested, maintainable, supportable production capabilities, not one-off experiments. Run validation as a program — own a structured adversary-emulation and control-validation practice that mimics real adversary behaviour to test our detection and response, surface the gaps that matter, and drive them to documented closure — sharpening investigation speed and quality along the way. Own the metrics — design, track, and report the KPIs that prove the team's value: ATT&CK-aligned coverage, detection quality and false-positive performance, validation and gap-closure outcomes, automation impact, and improvements in detection and response effectiveness — turning them into decisions and investment cases Use AI as a force multiplier — drive automation and AI to ship detections faster and at greater scale than rule-writing alone allows, and to make investigation and response more efficient so specialists spend their time on the meaningful, complex work that genuinely needs human expertise. Lead

The description is cut here. Read the full offer: https://jobsbylevel.com/jobs/proactive-cyber-defence-and-engineering-at-booking-com-17b994

Source: https://jobsbylevel.com/jobs/proactive-cyber-defence-and-engineering-at-booking-com-17b994

## Cite this page

Level. https://jobsbylevel.com/jobs/proactive-cyber-defence-and-engineering-at-booking-com-17b994.

Get job alerts: https://jobsbylevel.com/newsletter