Booking Holdings Romania - IT Risk & Compliance Officer

Booking Holdings Romania is a Center of Excellence based in Bucharest, Romania and was created to support the increasing business demands of the Booking Holdings Brands. The Center of Excellence provides access to specialized and highly skilled talent, leading industry best practices, and collaboration opportunities across all of our Brands.

As part of our Booking Holdings Romania team, you will have the opportunity to be a part of the world’s leading provider of online travel, with a mission of making it easier for everyone to experience the world through five-primary consumer facing brands: Booking.com, Priceline, Agoda, KAYAK and OpenTable.

Role description

Booking.com follows a defense in depth strategy for managing its risks. As part of this strategy, Booking has 3 departments focusing on each line of defense. Global Internal Audit (GIA) is responsible for the 3rd line of defense, Risk and Controls (R&C) is responsible for the 2nd line of defense, while the responsibility of 1st line has been distributed between process/control owners and the Trust, Risk, Assurance and Compliance (TRAC) team. The TRAC team is quasi Risk and Controls team closer to the 1st line (process and control owners) and supports in design and maintenance of the internal controls in line with Booking’s risk appetite.

The IT Risk & Compliance Officer is part of the Risk Management capability of TRAC and is responsible for partnering with risk owners throughout the Central Technology business function and other business units to support design and maintenance of internal controls in line with our risk appetite and to maintain the quality of our processes. The role requires to work closely with stakeholders from multiple departments and to have a strong big picture focus, but be able to zoom in and out of the details to ensure full process understanding.

The role is focused on leading the identification of technology-related risks for various technology platforms, including, but not limited to: cybersecurity, IT, privacy and regulatory compliance risks. This role requires engaging with senior technical stakeholders (developers, engineers, managers, etc.) to identify appropriate risk responses, and supporting and maintaining a fit-for-purpose IT controls framework, including the development of additional IT controls to manage risks.

The IT Risk & Compliance Officer is also a subject matter expert leveraging a deep understanding of the enterprise risk discipline combining deep knowledge of theory and organizational practice or expertise across several different disciplines within a function. This role requires solid knowledge of IT general controls and cybersecurity controls to mitigate technology-related risks across the organization. Successful risk expertise requires dynamic individuals who are able to liaise with various senior stakeholders and thus need to be articulate communicators, foster collaboration, integrate perspectives and drive to business beneficial outcomes.

This position requires strong stakeholder management skills and requires an individual who can influence others who are skeptical or unwilling to accept new concepts, practices and approaches.

This role provides a hybrid way of working with an onsite presence of 2 days/week.

Key Job Responsibilities and Duties

•

Build knowledge of internal controls, systems and process landscape to enable clear understanding of impact and Lead Initiative affecting wider organizations.

•

Looks for ways to increase the business impact of the team and improve the team’s services and how the team functions.

•

Promote control owners accountability for IT control performance and documentation.

•

Assess controls to provide assurance of control performance.

•

Provide advice on control & indicators design that are both sustainable and right sized (i.e. a simple solution for a simple problem, no overengineering).

•

Enable continuous improvement, maintaining our Booking.com controls catalogue, by providing general and technical guidance on how to maintain relevant controls.

•

Coordinate new requests from the business functions and units for support with controls.

•

Support business functions and units in ongoing compliance with SOX, PCI, GDPR and other control areas.

•

Provide support to SOX-IT Audits, PCI assessments, NIST Assessments, with needed walkthoughts, documentation and follow ups.

•

Assist in the development and leading of regular training/awareness programs to train and educate risk owners on internal controls topics.

•

Stay flexible to meet the dynamic business needs, while maintaining robust solutions that strengthen the control environment.

•

Be able to split large tasks into logical, manageable and decoupled actions which are managed effectively and delivered on time.

•

Support IT Risk and Compliance analysts when specific expertise is required.

•

Control mapping of internal control to industry frameworks and best practices.

•

Reporting on control execution, coverage, KPI and issues through booking reporting and dashboarding tools (Jira, Tableau, ServiceNow).

Role Qualifications and Requirements

•

5 - 8 years of relevant experience.

•

Bachelor’s Degree.

•

Work experience in business analysis, auditing, corporate governance, risk management or internal controls.

•

Ability to develop solid relationships with business partners in order to drive the adoption of the risk management culture.

•

Thorough technical understanding of internal control requirements and design and experience in applying them in various businesses.

•

Able to split large tasks into logical, manageable and decoupled actions which are managed effectively and delivered on time.

•

Knowledge of Regulatory and Compliance frameworks affecting Technology - SOX, PCI, NIST, COBIT.

•

Familiar with ServiceNow, Google Suite, Jira tools (or similar), Cloud environments is a plus, but not mandatory.

•

Familiarity with a DevOps environment is a plus, but not mandatory.

•

Excellent program management skills.

•

Strong stakeholder engagement skills (control/process owners, audit).

•

Demonstrates the ability to make decisions, assess and resolve problems effectively.

•

Enthusiastic, self-starting and enjoys change.

•

Hands-on experience with large e-commerce or tech companies is preferable.

•

Be flexible and agile in response to the change in business, change in stakeholder expectations and/or change in regulatory/operating environment of B.com.

•

Strong independent contributor, while still a strong team player.

Benefits & Perk s

•

Contributing to a high scale, complex, world renowned product and seeing real-time impact of your work on millions of travelers worldwide

•

Working in a fast-paced and performance driven culture

•

Technical, behavioral and interpersonal competence advancement via on-the-job opportunities, experimental projects, hackathons, conferences and active community participation

•

Competitive compensation and benefits package

•

Vast amounts of data to validate your ideas and the opportunity to experiment with real users

Booking Holdings is proud to be an equal opportunity workplace and is an affirmative action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. We strive to move well beyond traditional equal opportunity and work to create an environment that allows everyone to thrive.

Pre-Employment Screening

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.