Security Engineer(GCP)
Booking Holdings (NASDAQ: BKNG) · Bengaluru, Karnataka, India
- On site
- Full-time
- $150,000 / year
- Bengaluru, Karnataka, India
This role may have been filled. Drop your résumé and we'll check if it's still open — or find you similar roles.
Job highlights
- Protect world's largest travel platform's security.
- Design and implement cloud security architecture.
- Develop detective and preventive security controls.
- Automate remediation and advise on data safety.
- Collaborate with global security and platform teams.
About the role
About Booking Holdings
We believe that the passion and talent of our employees is our strength – it is what drives us towards outstanding performance. We offer a dynamic, motivating and sophisticated work environment. A culture that is open, innovative and performance-oriented. Our scale and scope, commitment to people and high standards of integrity make Booking.com a great place to work.
Booking.com’s Enterprise Security organisation is seeking a passionate engineer who wants to protect the world's largest travel platform against attacks on its production platform. Your skills will be the foundation of security initiatives that protect the security and privacy of all our customers, partners, and employees.
The Enterprise Security organisation makes security effortless for our different production platforms. As part of this team, you will be performing security engineering, building advanced and novel detective and preventive controls, developing systems to automate remediation and advise product and infrastructure teams on how to keep our data safe.
Responsibilities
- Design, implement, and maintain cloud security architecture for Google Cloud Platform (GCP) environment
- Configure and support security monitoring tools and security teams for threat detection and incident response
- Work closely with other security and platform teams to ensure cloud security measures meet regulatory requirements and contractual obligations (e.g. NIST, PCI DSS, GDPR, SOX)
- Support and respond to security incidents in cloud environments
- Optimise cloud security controls to balance security requirements with business needs and other requirements
- Support cloud security related assessments like pentests, audits and provide necessary documentation and evidence
- Conduct security reviews of cloud-based applications and services
- Participate in cloud architecture design discussions to ensure security is considered from the outset
- Participate in risk assessments and develop risk mitigation strategies for cloud deployments
- Provide security guidance and training to other teams within the organisation
- Communicate security concepts and risks to both technical and non-technical stakeholders
- Challenge ideas and methods while working together with talented, highly skilled team members;
- Help team members to improve their skills by providing technical guidance;
- Maintain and develop knowledge of cyber security trends;
Qualifications
- Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent practical experience).
- 6 - 12 years of professional experience in the Cloud Security domain.
- Cloud Platforms: Experience with Google Cloud Platform (GCP) and its security features. Knowledge of other public cloud platforms (e.g., AWS, Azure) is a strong advantage.
- Infrastructure as Code (IaC): Hands-on experience with IaC tools such as Terraform or Google Cloud Deployment Manager (Infra Manager).
- Cyber Security Expertise: Extensive knowledge of security engineering and cloud security principles.
- CSPM: Experience with a Cloud Security Posture Management (CSPM) / CNAPP tool, specifically Wiz.
- DevSecOps: Understanding of DevSecOps practices and security automation in CI/CD pipelines
- Scripting/Coding: Proficiency in coding and/or scripting using languages such as Bash, Golang, Python, Perl, or similar.
- Communication: Excellent written and verbal communication skills for effective stakeholder management.
- Security Assessments: Ability to perform security assessments and develop mitigation strategies for cloud deployments risks
- Compliance: Familiarity with major compliance frameworks and regulations (e.g., SOX, PCI DSS, GDPR).
Nice to have
- Certifications: Professional-level cloud security certifications, such as the Google Cloud Certified Professional Cloud Security Engineer.
- Linux security and Network Security knowledge (firewalls, vpn).
- Agile methodology knowledge and understanding.
- Knowledge of containerization technologies (e.g., Docker, Kubernetes) and associated security measures.
Pre-Employment Screening
If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.
Key skills/competency
- GCP Security
- Cloud Security Architecture
- Threat Detection
- Incident Response
- DevSecOps
- Infrastructure as Code
- Security Automation
- Compliance Frameworks
- Security Assessments
- Python
Skills & topics
- Security Engineer
- GCP
- Cloud Security
- Google Cloud Platform
- DevSecOps
- Cyber Security
- Incident Response
- Security Architecture
- Terraform
- Python
How to get hired
- Tailor your resume: Highlight your GCP security, IaC (Terraform), and scripting (Python, Bash) experience.
- Showcase compliance knowledge: Emphasize familiarity with NIST, PCI DSS, GDPR, SOX in your application.
- Quantify achievements: Use numbers to demonstrate impact in security assessments and incident response.
- Prepare for technical questions: Be ready to discuss cloud security principles and DevSecOps practices.
- Research Booking Holdings: Understand their commitment to security and customer privacy.
Technical preparation
Master GCP security controls and features.,Practice Infrastructure as Code with Terraform.,Build automation scripts in Python or Bash.,Familiarize with CSPM tools like Wiz.
Behavioral questions
Describe a complex security incident you handled.,How do you balance security with business needs?,Explain a security risk to non-technical stakeholders.,How do you help team members improve skills?
Frequently asked questions
- What is the primary focus of the Security Engineer GCP role at Booking Holdings?
- The Security Engineer GCP role at Booking Holdings focuses on protecting the company's production platform against cyber threats by designing, implementing, and maintaining cloud security architecture on Google Cloud Platform (GCP). This includes developing security controls, automating remediation, and advising teams on data protection.
- What are the key technical skills required for the Security Engineer GCP position?
- Key technical skills include extensive experience with Google Cloud Platform (GCP) and its security features, Infrastructure as Code (IaC) tools like Terraform, and proficiency in scripting languages such as Bash, Golang, or Python. Experience with CSPM tools like Wiz and DevSecOps practices is also crucial.
- Does Booking Holdings require specific certifications for the Security Engineer GCP role?
- While not strictly required, professional-level cloud security certifications, such as the Google Cloud Certified Professional Cloud Security Engineer, are considered a 'nice to have' and can strengthen your application for the Security Engineer GCP role.
- How important is compliance knowledge for this Security Engineer GCP role?
- Familiarity with major compliance frameworks and regulations such as NIST, PCI DSS, GDPR, and SOX is important. You will be working closely with teams to ensure cloud security measures meet these regulatory requirements and contractual obligations.
- What is the expected experience level for the Security Engineer GCP position at Booking Holdings?
- The role requires 6 to 12 years of professional experience in the Cloud Security domain, with a Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
- How does Booking Holdings approach pre-employment screening for this role?
- If your application is successful, Booking Holdings may conduct a pre-employment screening check by a third party. This may include employment history, education, and other relevant information to determine your qualifications and suitability for the Security Engineer GCP position.
- What kind of work environment can I expect as a Security Engineer GCP at Booking Holdings?
- You can expect a dynamic, motivating, and sophisticated work environment that is open, innovative, and performance-oriented. Booking Holdings emphasizes its culture of passion, talent, and integrity, making it a great place to work.