Risk and Compliance Officer

The DMLP 1st Line Risk & Compliance Officer owns the day-to-day coordination of risk, audit, and compliance activities for Booking.com's data and machine learning systems including Kafka, Flink, BDX, MySQL, and AI/ML platforms. This role establishes clear ownership, processes, and documentation across the DML risk landscape, acting as the primary risk partner to platform and service owners in this domain.

B.responsible

• Risk & Compliance Partnership: Act as the 1st line risk partner to DML platform owners and data teams (Kafka, Flink, BDX, MySQL, AI/ML systems), advising on risk exposure and tailoring PCI-DSS, NIST, SOX, and any other regulatory compliance requirements to data and ML environments.

• Discovery & Risk Assessments: Lead discovery reviews and risk assessments across data and AI/ML systems, identifying gaps in ownership, controls, and documentation, and driving remediation with the relevant control owners.

• Control Ownership & R&R Clarity: Maintain clear roles and responsibilities (R&R) documentation for DML ITGCs (e.g., BDX DMA), ensuring every control has a named 1st line owner and a defensible rationale grounded in official documentation.

• Audit & Compliance Follow-Up: Coordinate and lead platform compliance controls and audit follow-ups and matters, tracking remediation actions to closure and liaising with 2nd line/audit stakeholders.

• Risk Register & Reporting: Maintain the DML risk inventory, report on risk coverage, issues, and remediation status through tools such as JIRA and ServiceNow.

• Right-Sized Control Design: Provide advice on control design that is sustainable and right-sized simple solutions for simple problems, avoiding overengineering while keeping controls effective.

• Stakeholder Coordination & TRO representation: Establish relationships with senior stakeholders. Build and maintain robust relationships across engineering, platform ownership, and risk/audit teams to keep ownership, processes, and documentation aligned as the DML platform evolves.

• Continuous Improvement: Identify opportunities to automate manual compliance and reporting bottlenecks, and refine risk assessment methodology to keep pace with a fast-moving data/AI environment.

B.skilled

1. Comfortable coordinating across many stakeholders with minimal day-to-day supervision, in a fast-changing, sometimes ambiguous environment.

2. Strong documentation and communication skills and able to translate technical risk into clear, concise, business-friendly language.

3. Platform Risk & Cloud Fluency: Broad job knowledge (typically 5–8 years) in IT risk, audit, or controls, with hands-on exposure to cloud environments (AWS preferred) and the ability to translate data platform and streaming architecture  Kafka, Flink, BDX, MySQL, AI/ML pipelines  into concrete risk assessments and control requirements.

4. Control Framework Depth: Practical, applied knowledge of SOX and PCI-DSS, with the judgment to right-size controls so they stay effective and audit-ready without adding unnecessary friction for engineering teams.

5. Audit Support Experience: Comfortable preparing evidence, coordinating walkthroughs, and drafting remediation memos for internal/external audit and SOX cycles.

6. Structured Problem Solving: Able to work from individual findings toward reusable patterns, flagging when a local issue looks systemic so the wider team can decide on a shared guardrail.

7. Clear Communicator: Can translate technical risk into plain language for engineering, platform, and audit stakeholders, and hold a respectful but firm line in day-to-day discussions.

8. Certifications: CRISC (or actively working toward it) is preferred; the domains of Governance, IT Risk Assessment, Risk Response & Reporting, and Information Technology & Security map directly onto this role's daily work. CISA or equivalent is a plus.

Strategic Leadership & Confidence: Demonstrated ability to lead risk strategy with confidence and conviction. You are comfortable challenging senior stakeholders, independently steering complex decisions, and maintaining clarity in ambiguous environments without softening the core message.

Platform Risk & Cloud Expertise: Deep expertise in platform risk and compliance, with hands-on experience in cloud environments (AWS or cloud expertise preferred). You understand how to translate technical architecture, specifically data platforms, streaming infrastructure, and AI/ML systems into tangible risk assessments.

Control Framework Mastery: Strong practical knowledge of SOx and AWS. You don't just know the frameworks, you know how to "right-size" controls so they are effective, scalable, and audit-ready without creating unnecessary friction for engineering teams.

Systemic Problem Solving: A track record of moving beyond individual ticket-based risk management to designing scalable operating models. You can identify patterns, define reusable guardrails, and build "one coherent model" for risk that evolves alongside the platform.

Cross-Functional Influence: Exceptional ability to translate technical risk into business-friendly language for diverse stakeholders. You build robust partnerships across engineering, platform, and audit teams, acting as a go-to partner who enables velocity while ensuring compliance.

Familiarity with GenAI/AI governance risk concepts is a plus but not essential.

Success Looks Like:

• Sustainable Control Landscape: Every DML control (including Kafka, Flink, BDX, MySQL, and AI/ML) has a clear, documented, and accountable 1st-line owner. Controls are perceived as "right-sized" and integrated into the workflow rather than added hurdles.

• Audit & SOX Readiness: Audit follow-ups, remediation actions, and SOX-related compliance matters are tracked proactively and driven to closure on time, with no major surprises during review cycles.

• Proactive Risk Stewardship: Risk assessments for new data and AI initiatives are embedded before major architectural decisions are locked in, ensuring the platform scales securely by design.

• Trusted Strategic Partner: Your team is seen by engineering leadership not as a blocker, but as a critical partner in delivery. You are effectively navigating "shared goal" trade-offs, leaving stakeholders with clarity, respect, and a clear, workable path forward.

Pre-Employment Screening

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.