Booking Holdings Romania - Director, Global Security Center of Excellence

Booking Holdings Romania is a Center of Excellence based in Bucharest, Romania and was created to support the increasing business demands of the Booking Holdings Brands. The Center of Excellence provides access to specialized and highly skilled talent, leading industry best practices, and collaboration opportunities across all of our Brands.

As part of our Booking Holdings Romania team, you will have the opportunity to be a part of the world’s leading provider of online travel, with a mission of making it easier for everyone to experience the world through five-primary consumer facing brands: Booking.com, Priceline, Agoda, KAYAK and OpenTable.

Role description

This global technical leadership role applies professional disciplines combining deep knowledge of theory and organisational practice across several different disciplines within a function or several different job areas across functions, including cybersecurity, threat intelligence, incident management, business resilience, insider risk, cyber threat exposure management, and data security protection.

The role has two core components:

The senior leader provides measurable input in defining the direction of business and customer-aligned strategy, including designing, communicating and building buy-in for value-generating roadmap deliverables. The role is responsible for the design, development and implementation of the Shared Service Organisational concept, including the delivery and successful operation of structure and process that governs service demand, design, delivery, monitoring, compliance and ongoing improvement, with a focus on customer satisfaction, quality and cost.

The role drives the design and implementation of new products, processes and operational plans for the Global Security Shared Service Organisation. This individual analyses complex issues and modifies working methods in a broader work area.

As leader of the Global Security Center of Excellence, this role will support our strategic efforts to optimize our global 24/7 security prevention, detection and response capabilities (building up to 100 FTE). You will engage with leadership in the COE organization and beyond to build and shape the culture of the Security organisation alongside other leadership in the Center of Excellence and take an active role in leading and representing Security in both the Center of Excellence and the local market, ensuring that the organization is a fantastic place to work that attracts and retains top talent. This includes focussing on planning, governance, implementation, and optimisation of the nearshore/hybrid solution, and collaboration / partnership with leadership and brands to maintain and celebrate the organizational culture.

This strategic leadership role within the Bucharest site will involve direct leadership of the Global Security Shared Service Organisation, alongside indirect strategic input and influence over the delivery of broader security services via governance and customer engagement mechanisms. The role will lead the management of Bucharest security resources and will require both strategic and technical experience with innovative security ideas that reduce cyber and physical risk across the enterprise, alongside the business understanding to be able to drive value and commodities where appropriate.

The role demands thought leadership to support the delivery of vision, strategy, security policies, and standards of outsourced operations in a shared service environment, across multiple demanding jurisdictions. Managing multiple projects, you will be required to plan, analyse, estimate and establish the priorities required to ensure successful delivery of Center of Excellence requirements, as well as their execution.

You will be in regular contact with senior leadership in Booking.com and the broader Booking Holdings organization; therefore, the ability to communicate clearly and concisely, both in written and verbal form, is crucial to the role's success.

This role provides a hybrid way of working with an onsite presence of 2 days/week.

Key Job Responsibilities and Duties

[Service Governance and Leadership]

• This role is the “General Manager” of the Service Management Organisation (SMO) with all that entails including driving strategy, operations, financial management, demand planning, and continuous improvement. This role will drive strategic decisions related to the governance of services, own and optimise the SMO teams, products, processes and approach.

• Build an effective organisation that both supports and contributes to strategy, delivers structured governance and service enablement from birth to grave, including enabling demand management, capturing customer requirements, driving consistent above-brand implementation and co-ordinating service performance and customer engagement to the highest standard.

• Leads strategic and functional groups supporting Shared Services to operate above brand, allocate resources to minimize risk and remove roadblocks for complex or business-critical services.

• Create long-term plans that align with the overall focus of the Group and the constituent customer brands, taking into account financial, people and business strategy.

• Establishing annual strategic objectives, SMART goals and KPI’s that are shared, monitored and actioned by Senior Management and support continuous improvement.

• Drives the strategy and manages the plan for the delivery of all software systems required to support the Shared Service Management Organisation, alongside providing additional support to Service Owners.

• Enable service development and strategy setting with data-driven insights.

• Define and develop the SMO strategy to align with the broader organization’s strategy and goals.

[Service and Operations Management of the Global Security Center of Excellence]

• Responsible for the quality and efficiency of delivery of enterprise security operations and services of the Center of Excellence.

• Ensures incidents and crises are handled timely, effectively and appropriately within your area and impact is kept to a minimum.

• Ensures that information security risks are identified, evaluated and mitigated that align with the risk posture.

• Ability to understand the organization’s operations and be able to express cybersecurity priorities from a business perspective.

• Owns and is responsible for ensuring that playbooks, SOPs and other relevant Center of Excellence documentation is created, maintained and optimized.

• Acts as an escalation point to Capability Leads for major incidents and any other operations related issues.Ensures control effectiveness is monitored within the capability area and takes corrective action when needed.

• Responsible for the Global Security Center of Excellence to ensure security tools are effectively utilized and to identify gaps in process or procedure and implement new solutions accordingly.

[Program and Project management]

• Oversees all Program Management of the Global Security nearshore/hybrid operating model, ensuring appropriate staffing, capacity planning, and training for the team (up to 200 FTE).

• Lead coordination of delivery teams and project plans and enables delivery of the project requirements, including owning the analysis process of the required information, data, programming, and analysis.

• Drives the strategy and manages the plan for the delivery of all software systems required to support the broader Global Security Center of Excellence, based on requirements, data analysis and effort estimation, and establishes the deadlines for execution.

• Identifies and manages resource requirements, priorities, dependencies and milestones in order to meet project plan delivery timelines.

• Drives the creation and optimisation of delivery plans in line with functional objectives and any associated change management requirement.

• Proactively identifies and resolves issues that affect Program Delivery.Proactively identifies and removes blockers/impediments and consistently maintains a solution-focused approach.

• Lead the design, production and socialisation of a strategic roadmap for the Global Security Center of Excellence.

• Contribute to the establishment of a BKNG-wide cyber threat exposure management capability.

• Contribute to the establishment of an insider risk monitoring program.

• Contribute to the establishment of a BKNG-wide cyber data security protection program.

• Drive the creation of a BKNG Converged Threat Fusion Center that synchronizes physical and cyber threats in a seamless operations center.

[People and Team Management]

• Leads, manages, develops, and coaches a team of high performing security professionals working 24/7 to govern and manage Security Shared Services and to protect Booking Holdings brands and our customers.

• Responsible for developing team members and identifying opportunities for skill development and training. This will be done in coordination with Capability Leads and Service Owners.

• Coaching your team(s) using the Booking values on Think Customer First, Own It, Learn Forever, Succeed Together, and Do the Right Thing.

• Creates and nurtures the culture and working environment that attracts, engages and develops people to their full potential technical craft and retains them. This includes ensuring all staff are supported in their growth, through constant feedback, coaching and mentoring programs.

• Acts as a role model in driving these behaviors into the people managers and colleagues that deliver organizational goals.

• Supports the Security capabilities in achieving the 5Q’s requirements and ensure metrics are in place to measure ongoing performance.

[Collaboration and Stakeholder Management]

• Connect and influence senior-level management (C Level), including leadership of Executive workshops to socialize company risk position and strategy.

• Owns, maintains, and leverages strategic relationships in services and customer brands, including brand CISOs and related delivery teams, service owners and service delivery management teams and BHI leadership.

• Effectively communicate strategic department vision and key initiatives to team and run the implementation of these initiatives through to completion.

• Leverages relationships to influence outcomes and strategy, develops, agrees and owns performance metrics to demonstrate measurable delivery and value.

• Acts as an escalation and focal point between Capability Leads based in distributed brand locations and Bucharest security delivery teams.

• Responsible for managing the internal and external stakeholder relationships within the Center of Excellence team.Owns resources that manage day to day engagement between the Center of Excellence and brand colleagues.

• Drives continuous improvements and operational efficiency within the SMO and Center of Excellence, ensuring the appropriate resources and budget are applied to each topic and that the organisation and people are set up to deliver.

• Extraordinary organizational and project leadership skills.

• Demonstrated ability to work effectively with cross functional groups including technology, data analytics, product and program management.

• Develop relationships with key partners across Booking.com, including the security engineering track, product teams and business units, PR, HR, Legal, Privacy, Risk and Compliance, Commercial Operations and Finance.

• Create strong partnerships with security and other critical teams across the Booking Holdings group and represent Booking.com Security at Group level.

• Excellent verbal and written communication skills, polished interpersonal skills.

[Strategy and Leadership]

• Proven thought leader with 12+ years experience, including operational and technical strategy or corporate strategy as well as operational business roles.

• Expertise in technology, ideally in e-commerce, retail, and/or consumer facing products, is a must.

• 10+ years experience leading global security teams or mission critical operations teams at a high tech company where 24/7 availability is required

• Skilled in strategy development, including project scoping, hypotheses development, financial and business modeling, strategic options identification, consensus building, and implementation.

• Ability to learn fast and adapt to a fast moving environment

• Creativity and “out of the box” thinking that drives innovation. The ability to “see around corners” and “connect the dots” that enable business to proactively drive business, not just respond to it

• Strong executive presence and ability to communicate strategy clearly and simply

• Ease with executive-level interactions - ability to distill complex business issues and strategies to highlight insights and actionable recommendations in a concise and persuasive manner

• Ability to interact with people at all levels (from Board members to entry level employees)

• Ability to lead cross-functional collaboration in a highly matrixed and complex environment.

• Capable of managing multiple stakeholders with competing priorities.

• Independent thinker with excellent judgment

• Experienced in change management and scaling organizations

• Experience in vendor management and negotiations

• Demonstrates courage with difficult issues despite personal risk or discomfort and supports others who do so

Role Qualifications and Requirements

• Professional security management certification in one or more of the following areas preferred: CISSP, CISA, CISM, GISO, GCIH, CIPP.

• People Management

• Stakeholder Management

• Security Governance

• Business Management

• Expertise Operations

• Product Management

• Independence

• Data Privacy Awareness

• Computer Network Defence

• Incident Handling

• Incident Governance

• Business Resilience (crisis management/business continuity)

• Threat Management

• Vendor Management

• Emergency/disaster management, critical incident stress management, risk management

Demonstrated leader with team-oriented interpersonal skills; ability to effectively interface with a broad range of people and roles. Accept responsibility and personal accountability.

• 12+ years of experience as a technologist, ideally with specialization in cyber security

• 12+ years' experience with information security, identity access management, security risk

• Demonstrated experience designing, architecting, and implementing enterprise security programs and technology platforms for large operations.

• Consulting or product background

• National and international laws, regulations, policies, and ethics as they relate to cybersecurity

• Risk management processes (e.g., methods for assessing and mitigating risk).

• Information technology (IT) supply chain security and risk management policies, requirements, and procedures

Pre-Employment Screening

If your application is successful, your personal data may be used for a pre-employment screening check by a third party as permitted by applicable law. Depending on the vacancy and applicable law, a pre-employment screening may include employment history, education and other information (such as media information) that may be necessary for determining your qualifications and suitability for the position.