Senior Security Engineer - Threat Exposure Management, Pipeline

Booking Holdings Romania is a Center of Excellence based in Bucharest, Romania and was created to support the increasing business demands of the Booking Holdings Brands. The Center of Excellence provides access to specialized and highly skilled talent, leading industry best practices, and collaboration opportunities across all of our Brands.

As part of our Booking Holdings Romania team, you will have the opportunity to be a part of the world’s leading provider of online travel, with a mission of making it easier for everyone to experience the world through six-primary consumer facing brands: Booking.com, Priceline, Agoda, KAYAK, OpenTable and Rentalcars.com.

Role description

The Senior Security Engineer – serves as a technical lead and subject matter expert for the Threat Exposure Management (TEM) capability: designs, builds and operates the technical foundation across four areas: Threat Detection & Engineering, Security Tooling & Architecture, Threat Intelligence Integration, and Automation & Orchestration. The role exists to turn external threat information into timely, evidence-backed answers on whether Booking Holdings brands are exposed, and to route each relevant exposure to the accountable team, with visibility over the actions taken through to verified closure. Success means a scalable, auditable and federated capability, adopted by the brands, that measurably reduces the time needed to determine and remediate exposure.

This role provides a hybrid way of working with an onsite presence of 2 days/week.

Key Job Responsibilities and Duties

Threat Detection & Engineering

• Designs, builds and maintains exposure detection logic and threat hunting queries in line with the TEM data contract, to determine quickly and defensibly whether emerging threats affect Booking Holdings brands.
• Owns the operational health of the TEM pipeline and automations, including reliability and performance improvements.
• Translates threat intelligence and potential threats into detection use cases, validating and tuning them with brand detection and response teams to reduce false positives and evidence gaps.

Security Tooling & Architecture

• Designs and evolves the TEM technical architecture (threat intelligence aggregation, asset and software inventory, orchestration and case management) together with security architecture and brand engineering teams, ensuring a scalable, secure and federated capability.
• Evaluates, integrates and operates security tooling such as threat intelligence, cyber asset attack surface management (CAASM), SBOM and orchestration platforms, providing technical input to build-versus-buy decisions and applying least-privilege access, secrets management and change control.

Threat Intelligence Integration

• Integrates commercial, open-source and internal threat intelligence sources into a normalized, deduplicated signal pipeline, correlating threat indicators with brand assets and inventories to prioritize relevant exposures.
• Monitors feed health and ingestion and detects failures before they lead to wrong or missing exposure answers.
• Defines and maintains the exposure data model (affected components and versions, exposure window, evidence coverage, confidence), keeping threat credibility separate from internal exposure so that incomplete evidence is reported as indeterminate rather than as not affected.

Automation & Orchestration

• Builds and maintains automated workflows (e.g., low/no-code or native services) that route exposures to accountable brand owners, track SLAs and escalations, and keep an auditable record of the actions taken from intake to verified closure.
• Develops dashboards and reporting on TEM KPIs, such as time to exposure answer, evidence coverage, indeterminate rate and verified remediation, for technical teams and security leadership, using version control, testing and code review practices.

Cross-cutting

• Uses version control, automated testing, code review and controlled deployment practices across integrations, assessment logic and workflows. Documents designs, runbooks and integration standards, and shares knowledge with security and engineering colleagues.
• Researches emerging threats, attacker tactics and techniques, and automation methods to improve the capability. Evaluates AI-assisted workflows with appropriate data-handling safeguards, output validation and human review before consequential actions.
• Performs other duties as assigned

Role Qualifications and Requirements

Knowledge

• Security Automation & Orchestration - Advanced Application P4
• Threat Detection Engineering - Intermediate P3
• Threat Intelligence - Intermediate P3
• Security Tooling & Architecture - Intermediate P3
• Threat Management - Intermediate P3
• Vulnerability Management - Working Experience P2
• Stakeholder Management - Working Experience P4
• Risk Mindset - Working Experience P4

Skills and abilities

Required:

• 5+ years of experience in information security, security engineering or a related software or infrastructure engineering role
• Hands-on experience building asset/component matching, affected-version analysis, evidence freshness, detections, threat hunting or security data pipelines.
• Proficient in Python (or a comparable language), REST APIs, JSON and webhooks, with the ability to build and maintain reliable integrations
• Experience with security orchestration and automation platforms (e.g., low/ no code, native, cloud)
• Working knowledge of threat intelligence and vulnerability-prioritization concepts and standards (indicators, TTPs, STIX/TAXII, CVE, CVSS, EPSS, CISA KEV) and the MITRE ATT&CK framework
• Experience applying AI/LLM capabilities safely in security workflows (e.g., output validation, prompt-injection awareness)
• Working knowledge of cloud security (preferably AWS), asset inventory and software supply chain concepts (package ecosystems, SBOM, CI/CD)
• Experience with version control, infrastructure as code and CI/CD practices
• Experience building dashboards and security metrics
• Ability to communicate technical risk clearly to technical and non-technical audiences
• Analytical and problem-solving mindset
• Highly organized and efficient

Desirable:

• Experience with CAASM or threat intelligence platforms
• Experience in offensive security, vulnerability management or incident response
• One or more of the following certifications: GCTI, GCIH, GCDA, AWS Certified Security – Specialty, OSCP, CISSP or a similar recognized certification

Benefits & Perks

• Contributing to a high scale, complex, world renowned product and seeing real-time impact of your work on millions of travelers worldwide
• Working in a fast-paced and performance driven culture
• Technical, behavioral and interpersonal competence advancement via on-the-job opportunities, experimental projects, hackathons, conferences and active community participation
• Competitive compensation and benefits package
• Vast amounts of data to validate your ideas and the opportunity to experiment with real users

Booking Holdings is proud to be an equal opportunity workplace and is an affirmative action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. We strive to move well beyond traditional equal opportunity and work to create an environment that allows everyone to thrive.

Pre-Employment Screening

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.