Junior Application Security Analyst

Booking Holdings Romania is a Center of Excellence based in Bucharest, Romania and was created to support the increasing business demands of the Booking Holdings Brands. The Center of Excellence provides access to specialized and highly skilled talent, leading industry best practices, and collaboration opportunities across all of our Brands.

As part of our Booking Holdings Romania team, you will have the opportunity to be a part of the world’s leading provider of online travel, with a mission of making it easier for everyone to experience the world through five primary consumer-facing brands: Booking.com, Priceline, Agoda, KAYAK and OpenTable.

Role description

We are looking for a Junior Application Security Analyst to help protect applications and services through initial vulnerability triage, remediation follow-up, and investigation of application security alerts. Work with experienced colleagues using established procedures and playbooks.

This role provides a hybrid way of working with an onsite presence of 2 days/week.

Key Job Responsibilities and Duties

• Triage and validate reported application vulnerabilities from scanning tools, internal assessments and other reporting channels.

• Support initial severity assessment and prioritization using established guidance; flag uncertainty or potentially high-impact issues.

• Track assigned remediation items, follow up with development teams, and verify straightforward fixes using documented procedures.

• Review detection signals and alerts for exploitation attempts, suspicious application behavior, API misuse and automated abuse.

• Examine HTTP requests, application logs and available telemetry; identify likely false positives and document evidence.

• Escalate complex vulnerabilities, ambiguous alerts and urgent findings to senior colleagues.

• Maintain clear investigation records and contribute updates to triage and remediation playbooks.

• Record vulnerability source, affected application, reproduction evidence, ownership and remediation status; follow up on overdue items and escalate blockers.

• Use established risk criteria to consider CVSS severity alongside exposure, exploitability, affected functionality and known exploitation; seek guidance when evidence is incomplete.

• Review HTTP methods, parameters, responses, session and API activity to explain why an alert may indicate an attack rather than expected user behavior.

Role Qualifications and Requirements

• Bachelor’s Degree and 1-3 years of relevant experience

• Basic understanding of OWASP Top 10, HTTP/HTTPS, APIs, authentication, and authorization.

• Familiarity with vulnerability severity, risk, remediation, and common application attack patterns.

• Ability to interpret basic logs and alerts, organize evidence, and communicate findings clearly.

• Attention to detail, analytical curiosity, and ability to work constructively with colleagues.

• Ability to distinguish an observed attack attempt from a confirmed successful compromise and to state uncertainty clearly.

• 24/7 Availability

• Good English-speaking skills
  
  

Benefits & Perks

• Contributing to a high scale, complex, world renowned product and seeing real-time impact of your work on millions of travelers worldwide

• Working in a fast-paced and performance driven culture

• Technical, behavioral and interpersonal competence advancement via on-the-job opportunities, experimental projects, hackathons, conferences and active community participation

• Competitive compensation and benefits package

• Vast amounts of data to validate your ideas and the opportunity to experiment with real users
  
  

Booking Holdings is proud to be an equal opportunity workplace and is an affirmative action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. We strive to move well beyond traditional equal opportunity and work to create an environment that allows everyone to thrive.

Pre-Employment Screening

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.