Risk & Compliance Manager

Who you are

• Technical Specialization (specify per sub competence and Level):
• Strong risk and control or audit/assurance background with a deep understanding of operational and technology risk - L4
• Strong working experience with IT General Controls (ITGCs), especially in fast-paced DevOps environments
• Strong understanding of technology risk management, controls, and compliance, especially for public cloud platforms and DevOps Tooling - L4
• Experience and understanding of applicable regulations such as Sarbanes Oxley, PCI-DSS, GDPR and CCPA - L4
• Familiarity with industry-standard Cybersecurity regulatory frameworks such as NIST, ISO27001 and CIS - L3
• Understanding of cybersecurity risks and data protection principles - L3
• Technical AWS certifications (AWS Certified Solutions Architect, AWS Certified Security) are a plus
• Knowledge of secure software development practices and tooling (SAST, DAST, and SCA tools)
• Ability to cultivate solid relationships with business partners in order to drive the adoption of the risk management culture
• Thorough technical understanding of internal control requirements and design and experience in applying them in various businesses
• Able to split large tasks into logical, manageable and decoupled actions which are managed effectively and delivered on time
• Be flexible and agile in response to the change in business, change in stakeholder expectations and/or change in regulatory/operating environment of B.com
• Level of Education: Bachelor/Master
• Years of relevant Job Knowledge: Extensive Knowledge (8 - 12 years)

What the job involves

• Attract, engage, develop, and retain talent to their full potential by fostering a supportive work environment that emphasizes continuous feedback, coaching, and mentorship programs, ensuring comprehensive growth for all crafts
• Coaching your team on and consistently role model the Booking values on Think Customer First, Own It, Learn Forever, Succeed Together, and Do the Right Thing
• Drive initiatives effectively involving multiple technical first-line senior stakeholders, re-prioritising tasks when beneficial
• Formulate and implement tactical plans and objectives within Platform Risk Management that are in alignment with Central Tech business objectives and ensure the achievement of annual goals. Establish team priorities, delegate projects, allocate resources, and provide regular communication to management and business partners regarding business performance and project progress
• Advise first-line stakeholders with specialized knowledge and expertise in IT risk, cybersecurity and regulatory compliance risk. Assume responsibility for the identification of technological risks and the formulation of control design proposals. Offer guidance on control design that is sustainable and appropriately scaled, ensuring that solutions are commensurate with the complexity of the issues addressed and avoiding unnecessary overengineering
• Drive business engagement in the Central Tech business unit to provide risk and compliance awareness for teams that have a clear need to manage risks without significantly affecting their development velocity and/or play a key role towards achieving strategic objectives in the company
• Develop and maintain IT and security policies and procedures for secure software development & collaborate with development teams to integrate secure software development practices and principles into CI/CD pipelines
• Support senior stakeholders across central tech helping to promote and embed risk and compliance ownership across the business as well as to broaden and expand their knowledge base of both the internal and external risk environment
• Follow broader ERM strategy defined by R&C and implement it into execution within the first-line of defense (business) and drive continuous improvement of risk assessment methodologies through ongoing collaboration with second-line risk and controls teams, ensuring alignment with practical business objectives
• Support the team to identify ways to increase their business impact and improve the team’s product(s) and ways of working
• Liaise with other risk and audit teams (Risk and Controls, Internal Audit, external auditors, etc.) to provide a more in-depth technical risk perspective, as needed
• Stay current with emerging cyber threats and security best practices in DevOps environments

Benefits

• Health insurance
• Free access to Headspace for you and your loved ones
• Global Employee Assistance Program
• Meditation and Breastfeeding rooms at the office
• Booking Cares - 2 days per year to volunteer and learn
• Life insurance
• Disability insurance
• Pension plan
• Annual paid time off
• Parental leave - 22 weeks
• Grandparent leave - 10 days
• Care leave - 10 days
• Bereavement leave - up to 4 weeks
• Anniversary leave
• Working from Home Furniture and Ergonomic Support
• Working from Abroad - up to 20 days per year
• Discounts & Wallet credits to spend on our products
• Upgrade to Booking.com Genius Level 3
• Friends & Family Booking.com discount vouchers
• Free access to online learning platforms
• Development and mentorship programs to support career growth
• Access to trainings and workshops
• Team development opportunities
• Local discount programs
• Game rooms in offices
• On-site meals, coffee and snacks including vegan options