Application Security Engineer

Booking.comAmsterdamRemoteFull-time1 week ago

Booking.com is seeking an Application Security Engineer to protect customer-facing applications and APIs by engineering runtime security controls, improving detection, and responding to security incidents. The role requires 3–5 years of hands-on security engineering experience, practical WAF expertise (AWS WAF preferred), and scripting skills in Python, TypeScript, or JavaScript.

What you'll do

Implement, operate and improve WAF policies for internet-facing applications and APIs, including managed rule configuration, custom rules, rate limits and exceptions.
Make changes through CDK and CI/CD, with appropriate review, validation, rollout monitoring and rollback plans.
Assess how application-layer threats and observed attack patterns should be addressed at the edge.
Tune controls to reduce exposure while managing false positives and service impact; work with service owners to validate changes and explain their effect.
Use WAF, SIEM and relevant application or cloud telemetry to identify gaps in coverage.
Create or tune detection logic, queries, alert context and investigation playbooks.
Provide third-line technical escalation for application-facing security incidents.
Triage escalated alerts, establish what happened and which services or users may be affected, preserve relevant evidence, and coordinate containment or mitigation.
Document findings and recommendations, identify recurring patterns, and recommend proportionate improvements to WAF policy, detections, logging, runbooks or automation.
Write and maintain scripts or small tools that improve the safety, repeatability and efficiency of security operations, WAF changes, alert investigation and response workflows.
Coordinate with application, platform, security operations and incident response partners to implement agreed WAF or detection changes and investigate escalations.
Share findings, promote relevant security practices and raise broader trade-offs or priorities with senior colleagues.
Share practical guidance and help junior colleagues handle established WAF, detection and response tasks.

What you need

Must-have

AWS WAFWeb Application Firewall (WAF)Infrastructure as CodeCI/CDAWS CDKSIEMLog AnalyticsHTTP

Nice-to-have

AWS security and logging servicesWAF log analysisCloud-native application environmentsSIEM detection engineeringAlert tuningIncident playbooksSecurity automationOWASP web and API risks

Soft skills

Clear communicationSound judgementCollaborationIndependenceSupporting teammatesSharing practical guidance

Application SecuritySecurity EngineeringWAFAWSSIEMIncident ResponsePythonTypeScriptCI/CDSoftware Development

/What you'll do

/What you need

Must-have

Nice-to-have

Soft skills

What you'll do

What you need