Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 16 hours agoWe saw it 88 min after it went up

Risk and Compliance Officer

workingatbooking122 open roles

Where
Amsterdam, North Holland, Netherlands
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowRisk and Compliance Officerworkingatbooking · Amsterdam, North Holland, Netherlands

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on workingatbooking's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. workingatbooking postings stay open a median of 1 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 58.1%60 days
This job: posted 16 hours ago

workingatbooking median: 1 days open

The posting

The DMLP 1st Line Risk & Compliance Officer owns the day-to-day coordination of risk, audit, and compliance activities for Booking.com's data and machine learning systems including Kafka, Flink, BDX, MySQL, and AI/ML platforms. This role establishes clear ownership, processes, and documentation across the DML risk landscape, acting as the primary risk partner to platform and service owners in this domain.

B.responsible

  • Risk & Compliance Partnership: Act as the 1st line risk partner to DML platform owners and data teams (Kafka, Flink, BDX, MySQL, AI/ML systems), advising on risk exposure and tailoring PCI-DSS, NIST, SOX, and any other regulatory compliance requirements to data and ML environments.
  • Discovery & Risk Assessments: Lead discovery reviews and risk assessments across data and AI/ML systems, identifying gaps in ownership, controls, and documentation, and driving remediation with the relevant control owners.
  • Control Ownership & R&R Clarity: Maintain clear roles and responsibilities (R&R) documentation for DML ITGCs (e.g., BDX DMA), ensuring every control has a named 1st line owner and a defensible rationale grounded in official documentation.
  • Audit & Compliance Follow-Up: Coordinate and lead platform compliance controls and audit follow-ups and matters, tracking remediation actions to closure and liaising with 2nd line/audit stakeholders.
  • Risk Register & Reporting: Maintain the DML risk inventory, report on risk coverage, issues, and remediation status through tools such as JIRA and ServiceNow.
  • Right-Sized Control Design: Provide advice on control design that is sustainable and right-sized simple solutions for simple problems, avoiding overengineering while keeping controls effective.
  • Stakeholder Coordination & TRO representation: Establish relationships with senior stakeholders. Build and maintain robust relationships across engineering, platform ownership, and risk/audit teams to keep ownership, processes, and documentation aligned as the DML platform evolves.
  • Continuous Improvement: Identify opportunities to automate manual compliance and reporting bottlenecks, and refine risk assessment methodology to keep pace with a fast-moving data/AI environment.

B.skilled

  1. Comfortable coordinating across many stakeholders with minimal day-to-day supervision, in a fast-changing, sometimes ambiguous environment.
  2. Strong documentation and communication skills and able to translate technical risk into clear, concise, business-friendly language.
  3. Platform Risk & Cloud Fluency: Broad job knowledge (typically 5–8 years) in IT risk, audit, or controls, with hands-on exposure to cloud environments (AWS preferred) and the ability to translate data platform and streaming architecture Kafka, Flink, BDX, MySQL, AI/ML pipelines into concrete risk assessments and control requirements.
  4. Control Framework Depth: Practical, applied knowledge of SOX and PCI-DSS, with the judgment to right-size controls so they stay effective and audit-ready without adding unnecessary friction for engineering teams.
  5. Audit Support Experience: Comfortable preparing evidence, coordinating walkthroughs, and drafting remediation memos for internal/external audit and SOX cycles.
  6. Structured Problem Solving: Able to work from individual findings toward reusable patterns, flagging when a local issue looks systemic so the wider team can decide on a shared guardrail.
  7. Clear Communicator: Can translate technical risk into plain language for engineering, platform, and audit stakeholders, and hold a respectful but firm line in day-to-day discussions.
  8. Certifications: CRISC (or actively working toward it) is preferred; the domains of Governance, IT Risk Assessment, Risk Response & Reporting, and Information Technology & Security map directly onto this role's daily work. CISA or equivalent is a plus.

Strategic Leadership & Confidence: Demonstrated ability to lead risk strategy with confidence and conviction. You are comfortable challenging senior stakeholders, independently steering complex decisions, and maintaining clarity in ambiguous environments without softening the core message.

Platform Risk & Cloud Expertise: Deep expertise in platform risk and compliance, with hands-on experience in cloud environments (AWS or cloud expertise preferred). You understand how to translate technical architecture, specifically data platforms, streaming infrastructure, and AI/ML systems into tangible risk assessments.

Control Framework Mastery: Strong practical knowledge of SOx and AWS. You don't just know the frameworks, you know how to "right-size" controls so they are effective, scalable, and audit-ready without creating unnecessary friction for engineering teams.

Systemic Problem Solving: A track record of moving beyond individual ticket-based risk management to designing scalable operating models. You can identify patterns, define reusable guardrails, and build "one coherent model" for risk that evolves alongside the platform.

Cross-Functional Influence: Exceptional ability to translate technical risk into business-friendly language for diverse stakeholders. You build robust partnerships across engineering, platform, and audit teams, acting as a go-to partner who enables velocity while ensuring compliance.

Familiarity with GenAI/AI governance risk concepts is a plus but not essential.

Success Looks Like:

  • Sustainable Control Landscape: Every DML control (including Kafka, Flink, BDX, MySQL, and AI/ML) has a clear, documented, and accountable 1st-line owner. Controls are perceived as "right-sized" and integrated into the workflow rather than added hurdles.
  • Audit & SOX Readiness: Audit follow-ups, remediation actions, and SOX-related compliance matters are tracked proactively and driven to closure on time, with no major surprises during review cycles.
  • Proactive Risk Stewardship: Risk assessments for new data and AI initiatives are embedded before major architectural decisions are locked in, ensuring the platform scales securely by design.
  • Trusted Strategic Partner: Your team is seen by engineering leadership not as a blocker, but as a critical partner in delivery. You are effectively navigating "shared goal" trade-offs, leaving stakeholders with clarity, respect, and a clear, workable path forward.

Benefits & Perks - Global Impact, Personal Relevance:

Booking.com’s Total Rewards Philosophy is not only about compensation but also about benefits. We offer a competitive compensation and benefits package, as well unique-to-Booking.com benefits which include:

  • Annual paid time off and generous paid leave scheme including: parent, grandparent, bereavement, and care leave
  • Hybrid working including flexible working arrangements, and up to 20 days per year working from abroad (home country)
  • Industry leading product discounts - up to 1400 per year - for yourself, including automatic Genius Level 3 status and Booking.com wallet credit

Diversity, Equity and Inclusion (DEI) at Booking.com:

Diversity, Equity & Inclusion have been a core part of our company culture since day one. This ongoing journey starts with our very own employees, who represent over 140 nationalities and a wide range of ethnic and social backgrounds, genders and sexual orientations.

Take it from our Chief People Officer, Paulo Pisano: “At Booking.com, the diversity of our people doesn’t just build an outstanding workplace, it also creates a better and more inclusive travel experience for everyone. Inclusion is at the heart of everything we do. It’s a place where you can make your mark and have a real impact in travel and tech.”

We ensure that colleagues with disabilities are provided the adjustments and tools they need to participate in the job application and interview process, to perform crucial job functions, and to receive other benefits and privileges of employment.

Application Process:

  • Let’s go places together: How we Hire
  • This role does not come with relocation assistance.

Booking.com is proud to be an equal opportunity workplace and is an affirmative action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. We strive to move well beyond traditional equal opportunity and work to create an environment that allows everyone to thrive.

Pre-Employment Screening

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.

Pre-Employment Screening

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against workingatbooking's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on workingatbooking's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    workingatbooking's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.