Chief Information Security Officer (Turkey)

Bybit; Fatih; On-site; TRY 1,200,000 - 1,800,000; Full time

Job summary

Bybit, a leading cryptocurrency exchange, seeks a security executive in Turkey to lead audits, policy, and incident response. You will manage local security programs, cloud and wallet security, and regulatory interactions with SPK and TÜBİTAK.

You will also build and mentor the local security team and drive risk management across the organization. The role requires deep expertise in KVKK and multi-jurisdictional compliance, with strong Turkish and English communication.

Qualifications

• 8+ years of information security experience with leadership roles.
• Experience with Turkish regulators (SPK) and TÜBİTAK-type audits.
• Strong knowledge of KVKK implementation.
• Cloud, network and application security expertise.
• Experience building security programs in regulated financials.
• Excellent communication in Turkish and English.
• Ability to translate risk into business impact.

Responsibilities

• Serve as primary security contact for audits and regulatory inspections.
• Maintain local security policy aligned with SPK, TÜBİTAK and ISO 27001/NIST CSF.
• Lead local incident response as CISO-level commander for high-severity events.
• Oversee security architecture for local infra, cloud and customer platforms.
• Oversee controls for wallet infrastructure and key management per SPK.
• Build and manage the local security team and capabilities.
• Maintain risk register and present risk status to senior management.
• Act as security representative in management meetings and regulatory discussions

Skills

InfoSec leadership

Regulatory audits SPK

KVKK compliance

Cloud security

Network security

App security

Turkish & English

Risk management

Education

CISSP

CISM

CISA

ISO 27001 Lead Auditor

Job description

Bybit is one of the world’s fastest-growing cryptocurrency exchanges, serving more than 80 million registered users globally. We provide a professional platform where crypto traders and institutions can access innovative spot and derivatives products, ultra-fast execution infrastructure, institutional-grade security, and industry-leading customer support.

Key Responsibilities

• Serve as the primary security point of contact for SPK audits, TÜBİTAK external audits, penetration testing and regulatory inspections; prepare and present audit evidence and responses
• Maintain the local security policy framework aligned with SPK, TÜBİTAK and global standards (ISO 27001, NIST CSF), including access control, network security, encryption, logging, and incident management
• Lead local incident response as CISO-level incident commander for high-severity events
• Oversee the security architecture for local infrastructure, cloud environments (AWS, Huawei Cloud), and customer-facing platforms
• Oversee security controls for hot and cold wallet infrastructure supporting Turkish customer assets, Ensure key management procedures meet SPK custody requirements
• Build and manage the local security team; define roles, hire talent, develop capabilities
• Maintain the local information security risk register; present risk status and remediation plans to senior management and the Board
• Act as the security representative in the Turkish entity's management meetings and regulatory discussions

Requirements

Must Have

• 8+ years of information security experience, with at least 3 years in a CISO, Deputy CISO, or Head of Security role
• Demonstrated experience working with Turkish financial regulators (SPK) or participating in TÜBİTAK-criteria audits
• Strong knowledge of KVKK and its practical implementation
• Solid understanding of cloud security, network security, and application security
• Experience building security programs in regulated financial institutions (banking, fintech, capital markets, or crypto)
• Excellent communication skills in both Turkish and English
• Strong risk management mindset; ability to translate technical risk into business impact

Nice to Have

• Direct experience at a cryptocurrency exchange or digital asset company
• Familiarity with cryptoasset custody security, cold/hot wallet architecture, and key management
• Certifications: CISSP, CISM, CISA, ISO 27001 Lead Auditor
• Exposure to multi-jurisdiction compliance (EU, KZ, etc.)