Risk & Compliance Officer - Data Services

Overview

, data drives our decisions. Technology is at our core. And innovation is everywhere. We’re the thrill of the first night in a new place, the excitement of the next morning, the friends you encounter, the journeys you take, the sights you see, and the memories you make. Through our products, partners and people, we make it easier for everyone to experience the world.

About the team: MySQL-Service Discovery

The MySQL-service discovery team designs, builds, and operates ’s core service discovery solutions for MySQL database infrastructure. We enable reliable, automated, and scalable discovery and connectivity for thousands of MySQL instances across Business Units and technical platforms. We partner with engineering, infrastructure, and SRE peers to deliver resilient database access, drive engineering best practices, and ensure high availability to support ’s critical applications.

By leveraging automation and robust monitoring, we empower product teams to consume MySQL resources with minimal friction, maintain strong security, and meet the platform’s high operational standards. One big topic we are working on is migrating Databases to AWS.

The IT Risk & Compliance Officer partners with risk owners across the Tech function and other business units to design and maintain internal controls aligned with our risk appetite and to maintain process quality. The role requires working closely with stakeholders from multiple departments, with a strong big-picture view and the ability to zoom in on details to ensure full process understanding.

Responsibilities and skills required for the IT Risk Officer role align with the Capability Area they work in, such as Risk Management (risk identification, analysis, treatment), Risk Governance & Project Management (policy governance), or Third Party Risk Management & Customer Trust (3rd party risk). The IT Risk & Compliance Officer role requires solid stakeholder management skills and the ability to challenge risk owners to create robust, scalable solutions that mitigate key risks while enabling successful business operations.

R&C officers ensure adherence to regulations, internal policies, and industry best practices. This includes, but is not limited to:

• Risk Management:
  
  Support risk owners to design controls that mitigate relevant risks through implementation and monitoring.
• Advice on control design that is sustainable and appropriately scoped (simple solutions for simple problems, no over engineering).
• Coordinate new requests from business functions and units for support with controls.
• Participate in sprint planning sessions from development teams to support risk identification, assessment and treatment during the development lifecycle.
• Assist in developing and leading regular training programs to educate risk owners on internal controls topics.
• Remain flexible to meet dynamic business needs while maintaining robust solutions that strengthen the control environment.
• Risk Governance & Project Management:
  Support policy lifecycle management including design, implementation and adoption of policies, standards and guidelines in cybersecurity, privacy and regulatory compliance.
• Build knowledge of internal controls, systems and process landscape to enable understanding of impact from IT policies and standards.
• Manage exceptions to IT policies and standards.
• Third Party Risk and Customer Trust:
  Conduct third-party due diligence.
• Perform privacy and information security risk assessments at third parties. Identify opportunities to position data privacy and security as a competitive advantage improving brand-building and corporate reputation.
• Refer to the Booking R&C Resource Center for specific documentation and guidelines.

MySQL R&C Officer Specific Responsibilities

In addition to general R&C duties, the MySQL R&C Officer has the following specific responsibilities:

• Level 1 Operations and Control Execution
  • Actively engaged in Level 1 operations.
  • Run and execute controls directly, rather than just reviewing them.
  • Ensure the effectiveness of controls in real-time operations.
• Audit and Deficiency Management
  • Primary contact point for…