• The DMLP 1st Line Risk & Compliance Officer owns the day-to-day coordination of risk, audit, and compliance activities for Booking.com’s data and machine learning systems including Kafka, Flink, BDX, MySQL, and AI/ML platforms. This role establishes clear ownership, processes, and documentation across the DML risk landscape, acting as the primary risk partner to platform and service owners in this domain
• Risk & Compliance Partnership: Act as the 1st line risk partner to DML platform owners and data teams (Kafka, Flink, BDX, MySQL, AI/ML systems), advising on risk exposure and tailoring PCI-DSS, NIST, SOX, and any other regulatory compliance requirements to data and ML environments
• Discovery & Risk Assessments: Lead discovery reviews and risk assessments across data and AI/ML systems, identifying gaps in ownership, controls, and documentation, and driving remediation with the relevant control owners
• Control Ownership & R&R Clarity: Maintain clear roles and responsibilities (R&R) documentation for DML ITGCs (e.g., BDX DMA), ensuring every control has a named 1st line owner and a defensible rationale grounded in official documentation
• Audit & Compliance Follow-Up: Coordinate and lead platform compliance controls and audit follow-ups and matters, tracking remediation actions to closure and liaising with 2nd line/audit stakeholders
• Risk Register & Reporting: Maintain the DML risk inventory, report on risk coverage, issues, and remediation status through tools such as JIRA and ServiceNow
• Right-Sized Control Design: Provide advice on control design that is sustainable and right-sized simple solutions for simple problems, avoiding overengineering while keeping controls effective
• Stakeholder Coordination & TRO representation: Establish relationships with senior stakeholders. Build and maintain robust relationships across engineering, platform ownership, and risk/audit teams to keep ownership, processes, and documentation aligned as the DML platform evolves
• Continuous Improvement: Identify opportunities to automate manual compliance and reporting bottlenecks, and refine risk assessment methodology to keep pace with a fast-moving data/AI environment
• Success Looks Like:
• Sustainable Control Landscape: Every DML control (including Kafka, Flink, BDX, MySQL, and AI/ML) has a clear, documented, and accountable 1st-line owner. Controls are perceived as “right-sized” and integrated into the workflow rather than added hurdles
• Audit & SOX Readiness: Audit follow-ups, remediation actions, and SOX-related compliance matters are tracked proactively and driven to closure on time, with no major surprises during review cycles
• Proactive Risk Stewardship: Risk assessments for new data and AI initiatives are embedded before major architectural decisions are locked in, ensuring the platform scales securely by design
• Trusted Strategic Partner: Your team is seen by engineering leadership not as a blocker, but as a critical partner in delivery. You are effectively navigating “shared goal” trade-offs, leaving stakeholders with clarity, respect, and a clear, workable path forward

Benefits

• Health insurance
• Free access to Headspace for you and your loved ones
• Global Employee Assistance Program
• Meditation and Breastfeeding rooms at the office
• Booking Cares - 2 days per year to volunteer and learn
• Life insurance
• Disability insurance
• Pension plan
• Annual paid time off
• Parental leave - 22 weeks
• Grandparent leave - 10 days
• Care leave - 10 days
• Bereavement leave - up to 4 weeks
• Anniversary leave
• Working from Home Furniture and Ergonomic Support
• Working from Abroad - up to 20 days per year
• Discounts & Wallet credits to spend on our products
• Upgrade to Booking.com Genius Level 3
• Friends & Family Booking.com discount vouchers
• Free access to online learning platforms
• Development and mentorship programs to support career growth
• Access to trainings and workshops
• Team development opportunities
• Local discount programs
• Game rooms in offices
• On-site meals, coffee and snacks including vegan options

• Certifications: CRISC (or actively working toward it) is preferred; the domains of Governance, IT Risk Assessment, Risk Response & Reporting, and Information Technology & Security map directly onto this role’s daily work. CISA or equivalent is a plus
• Systemic Problem Solving: A track record of moving beyond individual ticket-based risk management to designing scalable operating models. You can identify patterns, define reusable guardrails, and build “one coherent model” for risk that evolves alongside the platform
• Platform Risk & Cloud Fluency: Broad job knowledge (typically 5–8 years) in IT risk, audit, or controls, with hands-on exposure to cloud environments (AWS preferred) and the ability to translate data platform and streaming architecture Kafka, Flink, BDX, MySQL, AI/ML pipelines into concrete risk assessments and control requirements
• Structured Problem Solving: Able to work from individual findings toward reusable patterns, flagging when a local issue looks systemic so the wider team can decide on a shared guardrail
• Platform Risk & Cloud Expertise: Deep expertise in platform risk and compliance, with hands-on experience in cloud environments (AWS or cloud expertise preferred). You understand how to translate technical architecture, specifically data platforms, streaming infrastructure, and AI/ML systems into tangible risk assessments
• Comfortable coordinating across many stakeholders with minimal day-to-day supervision, in a fast-changing, sometimes ambiguous environment
• Strategic Leadership & Confidence: Demonstrated ability to lead risk strategy with confidence and conviction. You are comfortable challenging senior stakeholders, independently steering complex decisions, and maintaining clarity in ambiguous environments without softening the core message
• Strong documentation and communication skills and able to translate technical risk into clear, concise, business-friendly language
• Control Framework Depth: Practical, applied knowledge of SOX and PCI-DSS, with the judgment to right-size controls so they stay effective and audit-ready without adding unnecessary friction for engineering teams
• Control Framework Mastery: Strong practical knowledge of SOx and AWS. You don’t just know the frameworks, you know how to “right-size” controls so they are effective, scalable, and audit-ready without creating unnecessary friction for engineering teams
• Clear Communicator: Can translate technical risk into plain language for engineering, platform, and audit stakeholders, and hold a respectful but firm line in day-to-day discussions
• Audit Support Experience: Comfortable preparing evidence, coordinating walkthroughs, and drafting remediation memos for internal/external audit and SOX cycles
• Cross-Functional Influence: Exceptional ability to translate technical risk into business-friendly language for diverse stakeholders. You build robust partnerships across engineering, platform, and audit teams, acting as a go-to partner who enables velocity while ensuring compliance
• Familiarity with GenAI/AI governance risk concepts is a plus but not essential