Head of Information Security

Yıldız Tech; Üsküdar; On-site; TRY 1,200,000 - 1,300,000; Full time

Job summary

Yıldız Tech seeks a senior Information Security leader to collaborate with the Information Security Director and oversee enterprise-wide security initiatives. You will drive governance, risk management, and regulatory compliance across the group, ensuring robust protection for infrastructure and applications.

Ideal candidates have 8+ years in information security, holding CISA/CISM/CISSP or equivalent, with fluency in English and Turkish, and strong communication skills to align security with

Qualifications

• Bachelor’s degree in a technical field or related discipline.
• Minimum 8 years of experience in information security governance, cybersecurity product management, risk, or compliance.
• Security frameworks: ISO 27001, NIST, COBIT, ITIL, PCI-DSS.

Responsibilities

• Lead design and continuous improvement of enterprise-wide Information Security Management System across Yıldız Holding and group companies.
• Identify information security risks and implement robust controls for infrastructure and applications.
• Establish security policies, standards, and best practices across application, infrastructure, and cloud domains.
• Ensure adherence to KVKK/GDPR, SOX, PCI-DSS; lead audits (COBIT, IT Controls) and remediate findings.
• Provide strategic and tactical security guidance for IT projects with regulatory alignment.
• Develop and report KPIs to measure security maturity and program effectiveness.
• Drive security and privacy awareness programs to foster a security-conscious culture across the organization.
• Collaborate with Finance, Legal, Audit to prioritize security investments and lead cross-functional teams.

Skills

Security governance

Cybersecurity product management

Regulatory compliance

ISO 27001

CISA/CISM/CISSP

Bilingual EN/Turkish

Strategic planning

Audit coordination

Education

Bachelor’s degree

Tools

COBIT

ITIL

PCI-DSS

Job description

The story of Yıldız Holding, which started with biscuit production in Istanbul in 1944, continues today with our food-snack products that we have reached 4 billion people in 5 continents with more than 300 brands and with our retail companies all over Turkey. With our 80 thousand employees, the majority of whom are located in Turkey, we aim to reach the better without stopping, and we produce a wide range of products from biscuits to chocolate, from frozen food to packaging in a total of 45 factories, 20 of which are abroad. We always raise the bar in economic contribution, employment, exports, social solidarity and sustainability. We give priority to social contribution with the principle of "Make Happy Be Happy" and we have been producing happiness for more than 80 years with our products, services and sustainable social responsibility understanding.

Our company Yıldız Tech, established to support the software development journeys of our digital applications within our group and to create innovative solutions, aims to enable our customers operating in the e-commerce sector to make the most of next-generation technologies, achieve success through digital and analytical solutions, and capitalize on emerging opportunities to attain sustainable benefits.

The role will work closely with the Information Security Director and provide regular updates on key initiatives, risks, and performance.

What Awaits You, What Will Be Your Responsibilities?

• Lead the design, implementation, and continuous improvement of the enterprise-wide Information Security Management System across Yıldız Holding and its group companies.
• Proactively identify information security risks and implement robust measures to safeguard infrastructure and applications from internal and external threats.
• Establish and maintain security policies, standards, and best practices across various domains, including application, infrastructure, and cloud services.
• Ensure adherence to statutory and regulatory requirements (KVKK/GDPR, SOX, PCI-DSS). Lead internal/external audit processes (COBIT, IT Controls) and oversee the resolution of findings.
• Provide strategic and tactical security guidance for IT projects, ensuring risk mitigation and regulatory alignment from the initiation phase.
• Develop and report on KPIs/metrics to measure the maturity, efficiency, and effectiveness of the security posture and compliance programs.
• Drive the development and management of enterprise-wide security and privacy awareness programs to foster a security-conscious culture.
• Collaborate with executive teams (Finance, Legal, Audit) to prioritize security investments and lead functional/technical teams in a complex corporate environment.

What will be the qualifications we expect from you?

• Bachelor’s degree from a reputable university, preferably in Computer Engineering, Industrial Engineering, Computer Science, Management Information Systems, Mathematics, Statistics, or related technical fields.
• Minimum 8 years of experience in information security governance, cybersecurity product management, business/technical analysis, or security-focused risk and compliance processes.
• Demonstrated competence in security control frameworks such as ISO 27001, NIST, COBIT, ITIL, and PCI-DSS.
• Deep understanding of regulatory landscapes including KVKK/GDPR and SPK requirements.
• Possession of CISA, CISM, CISSP, or equivalent professional certifications.
• Proven ability to devise strategic security plans and execute tactical initiatives in a matrix organization.
• Excellent verbal and written communication skills in both English and Turkish.

Which Skills Will Be Featuring You?

• Hands-on ability to build AI agents, workflows, and automations using AI-assisted tools to optimize security products and processes.
• Strong analytical and strategic thinking skills to assess complex cyber risks and align them with business objectives.
• Ability to translate complex technical security concepts into clear business terms for both technical and non-technical stakeholders.
• Proven track record in managing cross-functional projects and leading diverse stakeholders in high-pressure, multitasking environments.
• A result-oriented, problem-solving mindset with a strong business acumen and proficiency in professional tools (e.g., MS Office).