Risk and Compliance Officer, Booking.com

• Around 5-7 years of relevant experience in IT Risk, IT Controls, IT Compliance, Governance, IT Audit, or a related domain
• Strong understanding of control design, control effectiveness, control monitoring, and the relationship between risks, policies, standards, and controls
• Experience working with frameworks and regulations such as NIST, NIS2, DORA, or similar, and the ability to interpret requirements in a practical business and technology context
• A genuine interest in building, maintaining, and improving frameworks, control catalogues, or unified control models rather than only operating existing processes
• Ability to understand interdependencies across regulatory and framework requirements and bring coherence to overlapping controls
• Strong stakeholder management, influencing, and negotiation skills, with the confidence to challenge constructively and bring multiple parties together
• Strong written and verbal communication skills, especially the ability to turn complex requirements into clear guidance and actionable outcomes
• A structured, independent, and delivery-focused way of working, with comfort operating in ambiguity and driving progress across multiple workstreams
• Ability to zoom in and out on the details and contextualize IT and cyber regulatory requirements within Booking.com environment
• An innovative mindset and the judgment to spot quick-win automation opportunities that improve team velocity and quality

Desirable

• We are looking for an experienced IT Risk & Compliance Officer to join the team in Amsterdam
• This is an individual contributor role for someone with strong experience in the risk and controls domain and a genuine interest in building, improving, and maintaining control frameworks
• This role is ideal for someone who enjoys making sense of overlapping regulatory and framework requirements, bringing structure to control environments, and working with stakeholders to turn abstract requirements into practical, testable, and sustainable controls
• The role will play a key part in evolving the Unified Control Framework(UCF), supporting regulatory initiatives such as NIS2 and DORA, and helping ensure that risk and compliance requirements are addressed earlier in the software development lifecycle (shifting left) In practice, this involves executing the Unified Control Framework (UCF) strategy by contributing to its governance and roadmap definition, driving core regulatory compliance through NIS2 control mapping and refinement, and institutionalizing proactive risk management by designing reports on controls health
• Furthermore, this includes identifying and implementing pragmatic automation and AI-assisted improvements to accelerate analysis speed and bolster overall control quality
• Lead and support assessments of new and evolving regulatory or framework requirements, including NIST 2.0, NIS2, DORA, EU AI Act and other relevant cyber or technology compliance requirements, and determine how Booking.com should respond
• Build, maintain, and improve the Unified Control Framework by mapping requirements to internal policies, standards, assets, control objectives, and existing controls, with a strong focus on reuse, coherence, and reducing duplication
• Translate regulatory requirements and external recommendations into clear, practical, testable control descriptions with defined ownership, execution expectations, evidence requirements, and monitoring logic
• Collaborate with Risk Partners, control owners, domain experts, policy owners, and other stakeholders to align on control design, applicability, remediation needs, and implementation priorities
• Support Shift Left and Security NFR initiatives by ensuring that risk and control requirements are considered earlier in the SDLC and reflected in reporting, adoption logic, and risk insights
• Contribute to governance, reporting, and continuous improvement activities that help the business understand compliance posture, risk exposure, and control effectiveness more clearly
• Identify pragmatic automation or AI-enabled opportunities that can reduce manual effort, improve review velocity, and strengthen the consistency of assessments and control maintenance, without needing to be a dedicated automation engineer
• Success in this role means that new frameworks and regulations can be assessed faster and more consistently because requirements are connected to an evolving Unified Control Framework rather than being treated as standalone exercises each time
• It also means that controls become clearer and more operationally useful: ownership is defined, evidence expectations are explicit, control descriptions are testable, and overlaps across frameworks are handled in a more coherent way
• This person will be successful if they support control requirements, become more actionable earlier in the lifecycle, improve stakeholder alignment, and introduce practical ideas that reduce manual work while increasing confidence in the control environment