Application Security Engineer
Application Security Engineer on Booking.com's security team, based at the Amsterdam campus. Day to day: build and tune WAF protections for web apps and APIs via AWS CDK and CI/CD, investigate suspicious activity with SIEM telemetry, and serve as third-line escalation during application security incidents.
- Compensation
- Not disclosed
- Location
- Amsterdam Campus
- Work setup
- Hybrid
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- ~3–5 years of experience in security engineering, application security, cloud security, detection and response, or a closely related hands-on role; relevant bachelor's degree or equivalent practical e
- Practical experience designing, operating or tuning web application firewall controls
- Experience managing security configuration through code and delivery pipelines, with a working understanding of infrastructure as code
- Ability to investigate web and API activity using SIEM or log analytics tools: formulate queries, correlate events, assess alert quality
- Working knowledge of HTTP, web applications and APIs, common application-layer attack patterns, and edge mitigations
- Hands-on scripting or programming skills in Python, TypeScript, JavaScript, or a comparable language
- Experience participating in security incident investigations: triage, scoping, evidence gathering, containment coordination, documentation
- Clear communication and sound judgement; able to handle common tasks independently and collaborate with partners
Nice to have
- AWS WAF experience
- AWS CDK experience
- Experience with AWS security and logging services, WAF log analysis, or cloud-native application environments
- Familiarity with SIEM detection engineering, alert tuning, incident playbooks, or security automation
- Experience handling WAF false positives, application availability concerns, or coordination during a live security event
- Knowledge of OWASP web and API risks, bot or automated abuse patterns, and practical edge mitigation approaches
- Experience using version control and code review to manage security infrastructure changes
Full description
About Us: At Booking.com, data drives our decisions. Technology is at our core. And innovation is everywhere. But our company is more than datasets, lines of code or A/B tests. We’re the thrill of the first night in a new place. The excitement of the next morning. The friends you encounter. The journeys you take. The sights you see. And the memories you make. Through our products, partners and people, we make it easier for everyone to experience the world.
About the team: Our security team protects Booking.com’s websites, mobile apps and APIs from attacks and automated abuse. We build and operate security controls, including web application firewalls, bot detection and rate limiting, and use security data to identify and respond to threats. We work with product and engineering teams to improve protection while keeping services reliable and minimising the impact on legitimate customers and partners.
Role Description: Help protect customer-facing applications and APIs by engineering runtime security controls, improving application-focused detection, and providing hands-on technical support during security incidents. You will operate WAF protections delivered through infrastructure as code and CI/CD, use SIEM and application telemetry to investigate suspicious activity, and act as a third-line escalation for application security incidents.
Your expertise will directly contribute to the detection, prevention, and response to application security threats across Booking.com’s global platform.
Key responsibilities
- Build and maintain application protections. Implement, operate and improve WAF policies for internet-facing applications and APIs, including managed rule configuration, custom rules, rate limits and exceptions. Make changes through CDK and CI/CD, with appropriate review, validation, rollout monitoring and rollback plans.
- Make prevention practical. Assess how application-layer threats and observed attack patterns should be addressed at the edge. Tune controls to reduce exposure while managing false positives and service impact; work with service owners to validate changes and explain their effect.
- Improve detection and visibility. Use WAF, SIEM and relevant application or cloud telemetry to identify gaps in coverage. Create or tune detection logic, queries, alert context and investigation playbooks so that suspicious activity can be assessed quickly and consistently.
- Investigate and respond. Provide third-line technical escalation for application-facing security incidents. Triage escalated alerts, establish what happened and which services or users may be affected, preserve relevant evidence, and coordinate containment or mitigation with incident leads and service owners.
- Improve controls from incidents. Document findings and recommendations, identify recurring patterns, and recommend proportionate improvements to WAF policy, detections, logging, runbooks or automation. Implement assigned changes and track the actions you own to completion, coordinating with relevant owners when needed.