SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
KAYAK, part of Booking Holdings, is a leading travel search engine serving billions of queries across global metasearch brands including momondo, Cheapflights, and HotelsCombined. The Security team protects people, systems, and data powering travel for millions of users worldwide through close collaboration with engineering, operations, and product teams.
As a Security Engineer, you will drive KAYAK's vulnerability management program while contributing across multiple security domains in a collaborative, globally distributed environment. You will support and continuously improve vulnerability management processes—defining workflows for identifying, prioritizing, tracking, and driving remediation of security findings across infrastructure and applications. You'll work closely with engineering, operations, and IT teams to ensure findings are understood, assigned, and resolved timely, and report on program health and trends to security leadership.
You will participate in incident response activities including triage, investigation, containment, and post-incident documentation. You'll support application security initiatives such as automated code scanning, dependency analysis, and working with engineering teams to address security findings early in development. You'll help configure, monitor, and improve security tooling across endpoint protection, email security, identity and access management, and cloud security posture. You'll contribute to security automation and orchestration workflows that reduce manual effort and improve response times, collaborate with teams to embed security thinking into development workflows and infrastructure changes, and document processes and runbooks to support team knowledge sharing.
Additional responsibilities include participating in access reviews, supporting identity and access management processes, staying current with the evolving threat landscape, and contributing ideas for improving detection and response capabilities.
REQUIREMENTS:
- Solid understanding of cybersecurity fundamentals including networking, operating systems (Linux, macOS, or Windows), and cloud environments, gained through formal education, self-study, bootcamps, or professional experience
- Hands-on experience in at least one security domain: vulnerability management, incident response, application security, endpoint security, or identity and access management
- Experience working with security tooling (vulnerability scanners, endpoint detection and response platforms, SIEM systems, or similar); willingness to learn the company's stack is valued over exact tool experience
- Familiarity with AI tools and their application in security contexts (automating workflows, triaging alerts, improving detection and response); experience with AI models or AI-assisted workflows is a plus
- Clear communication ability in writing and conversation; globally distributed team works primarily in English (professional working proficiency sufficient; native fluency not required)
- Collaborative problem-solving approach; ability to ask questions, share learning, and support teammates
- Comfort working with autonomy on assigned tasks and projects while knowing when to seek input
BONUS:
- Familiarity with NIST Cybersecurity Framework or similar security frameworks
- Experience with cloud environments (AWS or GCP) or container security
- Exposure to security automation or scripting (Python, workflow automation tools)
- Experience in regulated environments (SOC 2, PCI)
