6 days ago

Manager, Proactive Cyber Defence & Engineering

Booking.com

Amsterdam

6 days ago

Apply

Booking.com is seeking a Manager, Proactive Cyber Defence & Engineering to lead a team of nine specialists across Amsterdam and Bucharest. The role requires 5+ years in cybersecurity and 2+ years managing technical specialists, with deep expertise in threat-informed defence, detection engineering, and adversary emulation. This is a people-first leadership position focused on scaling detection and response capabilities across a global technology environment.

AI-enabledHybridFull-timeSeniorCybersecuritySecurity Engineering

Manager, Proactive Cyber Defence & Engineering

Apply

AI-enabledHybridFull-timeSeniorCybersecurity

Salary

Not specified

Work Location

Amsterdam, North Holland, Netherlands, NL

Work Model

Hybrid working including flexible working arrangements, and up to 20 days per year working from abroad (home country)

Experience Required

5 years

Employment Type

Full-time

Experience Level

5+ years in cybersecurity, security engineering, threat research, or detection & response; 2+ years directly managing and developing engineers, researchers, or other senior technical specialists

Core Qualifications

Technical (Must-have)

CybersecuritySecurity EngineeringThreat ResearchDetection & ResponseThreat HuntingAdversary EmulationDetection EngineeringTelemetrySIEMSOARResponse AutomationMITRE ATT&CKDetection-as-CodeCI/CDAI-driven capabilities

Soft Skills

LeadershipStakeholder CommunicationPeople ManagementEmpathyAccountabilityDelegationCoachingPsychological SafetyPrioritisationAlignment

Key Responsibilities

•Shape strategy in partnership with leadership — translate the broader Cyber Defence strategy into a clear, risk-based plan for the team, set priorities, and own resource assignment and capacity planning
•Expand coverage where it counts most — lead the push for high-value telemetry and detection coverage across crown jewels, identity, cloud, and parts of the estate where visibility doesn't exist yet or needs maturity
•Establish detection & response engineering at scale — bring the cutting edge of how the industry does detection engineering into how we do it: detection-as-code, peer review, testing and validation, CI/CD, tuning, and retirement of stale logic
•Run validation as a program — own a structured adversary-emulation and control-validation practice that mimics real adversary behaviour to test detection and response, surface gaps, and drive them to documented closure
•Own the metrics — design, track, and report KPIs that prove the team's value: ATT&CK-aligned coverage, detection quality and false-positive performance, validation and gap-closure outcomes, automation impact, and improvements in detection and response effectiveness
•Use AI as a force multiplier — drive automation and AI to ship detections faster and at greater scale, and to make investigation and response more efficient
•Lead exceptional people — this is a people-first role above all
•Build visibility & partnerships across the business — represent the team's program clearly to senior leadership, and collaborate with a broad set of stakeholders across the organisation
•Confidently lead experienced specialists with strong technical viewpoints creating alignment and clear direction while keeping constructive debate healthy
•Bring structure and prioritisation to senior people: aligned autonomy, clear ownership, and accountability for finishing and productionising what they start
•Coach senior researchers and engineers to grow their impact, and build cohesion across two locations
•Create genuine psychological safety — empathy, humility, room to raise concerns early alongside clear expectations and honest performance conversations
•Delegate well and protect the team from fragmented, low-value work
•Connect the team's technical work to business and risk outcomes, and carry that story upward with credibility
•Participate in the team's on-call rotation

Cyber DefenceDetection EngineeringThreat ResearchAdversary EmulationSecurity LeadershipMITRE ATT&CKSOARSIEMHybridAmsterdam

Core Qualifications

Technical (Must-have)

Soft Skills

LeadershipStakeholder CommunicationPeople ManagementEmpathyAccountabilityDelegationCoachingPsychological SafetyPrioritisationAlignment

Key Responsibilities

•Shape strategy in partnership with leadership — translate the broader Cyber Defence strategy into a clear, risk-based plan for the team, set priorities, and own resource assignment and capacity planning

•Expand coverage where it counts most — lead the push for high-value telemetry and detection coverage across crown jewels, identity, cloud, and parts of the estate where visibility doesn't exist yet or needs maturity

•Establish detection & response engineering at scale — bring the cutting edge of how the industry does detection engineering into how we do it: detection-as-code, peer review, testing and validation, CI/CD, tuning, and retirement of stale logic

•Run validation as a program — own a structured adversary-emulation and control-validation practice that mimics real adversary behaviour to test detection and response, surface gaps, and drive them to documented closure

•Own the metrics — design, track, and report KPIs that prove the team's value: ATT&CK-aligned coverage, detection quality and false-positive performance, validation and gap-closure outcomes, automation impact, and improvements in detection and response effectiveness

•Use AI as a force multiplier — drive automation and AI to ship detections faster and at greater scale, and to make investigation and response more efficient

•Lead exceptional people — this is a people-first role above all

•Build visibility & partnerships across the business — represent the team's program clearly to senior leadership, and collaborate with a broad set of stakeholders across the organisation

•Confidently lead experienced specialists with strong technical viewpoints creating alignment and clear direction while keeping constructive debate healthy

•Bring structure and prioritisation to senior people: aligned autonomy, clear ownership, and accountability for finishing and productionising what they start

•Coach senior researchers and engineers to grow their impact, and build cohesion across two locations

•Create genuine psychological safety — empathy, humility, room to raise concerns early alongside clear expectations and honest performance conversations

•Delegate well and protect the team from fragmented, low-value work

•Connect the team's technical work to business and risk outcomes, and carry that story upward with credibility

•Participate in the team's on-call rotation