• The Baseline: 5 to 8 years of heavy operational security experience (Incident Response, SOC, Threat Hunting, DFIR, Malware Analysis).
• Leadership Chops: At least 1 year of direct management experience leading, mentoring, and scaling a team of highly skilled Incident Responders.
• Incident Command: Proven ability to step into the chaos of a complex, high-impact security incident, assess risk quickly, and coordinate a decisive response across multiple technical and business units.

• Practitioner at Heart: You are a leader, but you are still well-plugged into the world of hacking and defense. You can roll up your sleeves to read logs, collect technical evidence, and piece together the full picture of an attack.
• Adversary Knowledge: Deep, practical understanding of modern attacker methodologies (TTPs) and how to hunt them using enterprise-grade security tools.
• Infrastructure Fluent: Robust understanding of enterprise IT (networking, cloud, virtualization) and deep, advanced knowledge of at least one major OS architecture (Windows, Linux, or macOS).
• Process Architect: Solid experience writing, tuning, and maintaining operational IR playbooks, runbooks, and workflow documentation.

• Education & Certs: A Bachelor’s Degree (or equivalent real-world experience), ideally backed by respected, hands-on technical certifications (e.g., GCIH, GCFA, OSCP, OSCE, GREM, etc.).
• Communication: Exceptional interpersonal skills with the ability to translate highly complex technical findings into clear, actionable advice for both technical engineering teams and non-technical stakeholders.
• The "Can-Do" DNA: You are a self-starter who takes extreme ownership. You are flexible, solution-oriented rather than problem-oriented, and proactively look for ways to optimize your team's capabilities.
• Mission Ready: Willingness to participate in the on-call rotation and work non-standard hours when critical incidents strike.

• Coach & Scale: Lead, mentor, and grow a team of multiple elite Incident Responders. Build a culture of continuous learning, high performance, and psychological safety.
• Own the Roadmap: Partner with Cyber Defense & Response (CDR) leadership to build and implement a forward-looking strategy for our defense capabilities.
• Goal Setting & Impact: Define clear, actionable goals for the team and track success through impactful metrics (MTTD, MTTR) rather than just tracking busywork

• Command the Operation: Oversee day-to-day cyber operations across multiple defense services, including our Threat Hunting Capabilities
• Automate & Optimize: Champion continuous improvement. Relentlessly find opportunities to tune detections, automate repetitive tasks, and streamline our playbooks and workflows.
• Stakeholder Alignment: Act as the bridge between technical operations and senior leadership. Provide sharp, granular metrics and clear executive updates that translate technical risk into business impact.

• The Final Escalation: Act as the ultimate escalation point. When a complex, Sev-1 incident hits, you are rolling up your sleeves, guiding the technical investigation, and driving mitigation.
• Continuous Testing: Support or Partner with Red, Blue, and Purple teams during live exercises. Use the findings to harden Booking.com’s defenses and close visibility gaps.
• Always Ready: Guarantee 24/7 protection of the Booking.com brand by managing the team's out-of-hours scheduling and readiness, while also actively sharing the load by personally providing on-call escalation support (nights, weekends, and holidays) as needed.

• Health insurance
• Prepaid medical subscription (Regina Maria)
• Life insurance
• Meal vouchers
• Learning wallet
• Travel benefit
• Annual vacation leave of 25 business days, pro rata with the working period
• Birthday day off
• Summer break (short Fridays during summer)
• Work from Abroad program (up to 20 days/year in EU)
• Floating days off
• 2 Volunteer days/ year
• Home office one-time bonus
• Bookster
• Linkedin learning platform
• Headspace
• Employee discounts (travel, gym, dental, vision)

Booking Holdings Center of Excellence is part of Booking Holdings, the world's leading provider of online travel and related services, with a rich heritage of digital innovation. The Center provides access to specialized and highly skilled talent, supports projects powered by new and emerging technologies, leverages industry best practices, and fosters collaboration opportunities across all of the Booking Holdings brands, including Booking.com, Priceline, Agoda, KAYAK and OpenTable.

If you are interested to find out more about the Booking Holdings Center of Excellence visit our website: www.bookingholdings-coe.com.

Booking Holdings (NASDAQ: BKNG) is the world’s leading provider of online travel and related services, provided to consumers and local partners in more than 220 countries and territories through five primary consumer facing brands: Booking.com, Priceline, Agoda, KAYAK and OpenTable. The mission of Booking Holdings is to make it easier for everyone to experience the world.