Senior Security Architect

About Us: At Booking.com, data drives our decisions. Technology is at our core. And innovation is everywhere. But our company is more than datasets, lines of code or A/B tests. We’re the thrill of the first night in a new place. The excitement of the next morning. The friends you encounter. The journeys you take. The sights you see. And the memories you make. Through our products, partners and people, we make it easier for everyone to experience the world.

Role Description: The Senior Security Architect exists to make it easier for engineers to build secure, resilient systems without slowing delivery down. Reporting to the Director of Architecture, the role leads the security architecture domain within Tech Standards.

Tech Standards is the central architecture capability that turns Booking.com's enterprise architecture direction into practical principles, guidance, sensible defaults, and reusable patterns. Its purpose is to reduce cognitive load for engineering teams, make good technical choices easier to apply, and help Business Units move faster with confidence.

The role works closely with Security, SRE, Business Unit architects, and engineering teams to ensure security expectations are clear, actionable, and embedded into how software is designed, built, and run. It is not a gatekeeper role. It is an enablement role, focused on making secure engineering the default path.

A core part of the role is helping define the security non-functional requirements that form part of Booking.com's architecture guidance, in close partnership with the Security organisation. Success depends on combining deep security architecture expertise with the ability to influence senior technical communities, make trade-offs clear, and help teams adopt better security practices in real delivery work.

Key Job Responsibilities and Duties:

• Own the security architecture domain within Tech Standards, aligned with the Director of Architecture's enterprise architecture direction.
• Translate Booking.com's Tech Guiding Principles into practical security architecture guidance, patterns, and defaults that reduce friction for engineering teams.
• Work with the Security organisation to shape security non-functional requirements that are clear, practical, and usable by engineering teams.
• Turn security requirements, policies, and audit findings into architecture guidance and reference patterns that teams can apply without unnecessary manual gates.
• Partner with Business Unit architects, engineering leaders, Security, and SRE to make security guidance relevant to real delivery needs.
• Provide a strategic enterprise view of security architecture across identity, access, data protection, network security, application security, resilience, infrastructure, and cloud security.
• Champion shift-left security by embedding security thinking into the software development lifecycle and product delivery lifecycle.
• Define practical patterns for zero-trust architecture and help teams adopt them in ways that fit Booking.com's technology estate.
• Help teams understand the trade-offs between security, delivery speed, resilience, complexity, and operational cost.
• Coach and mentor architects and engineering communities so security architecture becomes easier to understand and apply.

Qualifications & Skills:

• Significant experience in technology, with strong experience in security architecture at enterprise scale.
• Deep understanding of enterprise security domains, including identity and access management, data protection, network security, application security, infrastructure security, and cloud security.
• Proven ability to design security architecture that works in large, distributed engineering organisations.
• Experience shaping security non-functional requirements, architectural guidance, reference patterns, and technical guidance.
• Strong understanding of zero-trust principles and how to