Risk and Compliance Officer

Join <Booking.com> as a Risk and Compliance Officer, where you will be responsible for the day-to-day coordination of risk, audit, and compliance activities for our data and machine learning systems. You will act as the primary risk partner to platform and service owners, lead discovery reviews and risk assessments, maintain clear roles and responsibilities documentation, coordinate audit and compliance follow-ups, and report on risk coverage and remediation status. You will also provide advice on control design, establish relationships with senior stakeholders, identify opportunities for continuous improvement, and ensure a sustainable control landscape.

• Act as the 1st line risk partner to DML platform owners and data teams, advising on risk exposure and tailoring compliance requirements.
• Lead discovery reviews and risk assessments across data and AI/ML systems, identifying gaps in ownership, controls, and documentation.
• Coordinate and lead platform compliance controls and audit follow-ups, tracking remediation actions to closure and liaising with stakeholders.

• Certifications: CRISC (or actively working toward it) is preferred; the domains of Governance, IT Risk Assessment, Risk Response & Reporting, and Information Technology & Security map directly onto this role's daily work. CISA or equivalent is a plus
• Systemic Problem Solving: A track record of moving beyond individual ticket-based risk management to designing scalable operating models. You can identify patterns, define reusable guardrails, and build "one coherent model" for risk that evolves alongside the platform
• Platform Risk & Cloud Fluency: Broad job knowledge (typically 5–8 years) in IT risk, audit, or controls, with hands-on exposure to cloud environments (AWS preferred) and the ability to translate data platform and streaming architecture Kafka, Flink, BDX, MySQL, AI/ML pipelines into concrete risk assessments and control requirements
• Structured Problem Solving: Able to work from individual findings toward reusable patterns, flagging when a local issue looks systemic so the wider team can decide on a shared guardrail
• Platform Risk & Cloud Expertise: Deep expertise in platform risk and compliance, with hands-on experience in cloud environments (AWS or cloud expertise preferred). You understand how to translate technical architecture, specifically data platforms, streaming infrastructure, and AI/ML systems into tangible risk assessments
• Comfortable coordinating across many stakeholders with minimal day-to-day supervision, in a fast-changing, sometimes ambiguous environment
• Strategic Leadership & Confidence: Demonstrated ability to lead risk strategy with confidence and conviction. You are comfortable challenging senior stakeholders, independently steering complex decisions, and maintaining clarity in ambiguous environments without softening the core message
• Strong documentation and communication skills and able to translate technical risk into clear, concise, business-friendly language
• Control Framework Depth: Practical, applied knowledge of SOX and PCI-DSS, with the judgment to right-size controls so they stay effective and audit-ready without adding unnecessary friction for engineering teams
• Control Framework Mastery: Strong practical knowledge of SOx and AWS. You don't just know the frameworks, you know how to "right-size" controls so they are effective, scalable, and audit-ready without creating unnecessary friction for engineering teams
• Clear Communicator: Can translate technical risk into plain language for engineering, platform, and audit stakeholders, and hold a respectful but firm line in day-to-day discussions
• Audit Support Experience: Comfortable preparing evidence, coordinating walkthroughs, and drafting remediation memos for internal/external audit and SOX cycles
• Cross-Functional Influence: Exceptional ability to translate technical risk into business-friendly language for diverse stakeholders. You build robust partnerships across engineering, platform, and audit teams, acting as a go-to partner who enables velocity while ensuring compliance
• Familiarity with GenAI/AI governance risk concepts is a plus but not essential