Information Security Executive

Bayegan; Pendik; Presencial; TRY 600.000 - 900.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Professional development opportunities

Long-term career growth

Cross-functional international teams

Descripción de la vacante

Bayegan seeks a Senior Information Security & Compliance Executive to safeguard information assets and drive GRC. Translate risks into business actions, oversee security operations, and coordinate audits with legal, IT, and external partners.

You will lead controls across endpoints, identities, email, cloud, and applications, manage ISO 27001 activities, KVKK/GDPR, and risk-based improvements while engaging with stakeholders in Turkish and English.

Formación

• Bachelor’s degree in a related field and 5+ years in information security, cyber operations, security engineering, IT risk, audit, or GRC.
• Hands-on with Microsoft Defender products; Defender for Cloud, Sentinel, Entra ID, Intune, Purview experience desirable.
• Experience with EDR/XDR, SIEM/SOAR, vulnerability management, and email security.
• Knowledge of KVKK and GDPR; ability to translate compliance into technical controls.
• Certifications such as ISO 27001 Lead Auditor, CISSP, CISM, CASP are assets.
• Strong documentation, stakeholder management, and English/Turkish communication.

Responsabilidades

• Operate, monitor, and continuously improve enterprise security controls across endpoints, identities, email, cloud services, apps, and users.
• Administer Microsoft security capabilities (Defender XDR, Defender for Endpoint/Office 365, Cloud, Sentinel, Entra ID, Purview, Intune).
• Coordinate SOC operations and MSPs; monitor service quality, use cases, alerts, incident response, and SLAs.
• Support ISO/IEC 27001 activities: risk assessments, SoA, internal audits, management reviews, and certification activities.
• Assess KVKK/GDPR compliance with Legal and business teams; drive remediation and controls.
• Plan vulnerability management, penetration tests, remediation tracking, and risk acceptance processes.
• Lead cyber incident response, root-cause analysis, evidence preservation, and post-incident improvements.
• Embed security and privacy into infrastructure, cloud, apps, procurement, and supplier projects.
• Conduct third-party security assessments and monitor supplier risks and security commitments.
• Prepare security KPIs/KRIs, risk summaries, audit findings, and management presentations.

Conocimientos

Information Security

GRC

Risk Management

Auditing

Incident Response

Cloud Security

Microsoft Defender

KVKK/GDPR

ISO 27001

English/Turkish

Educación

Bachelor's degree in Computer Engineering/CS/IS

Herramientas

Trend Micro

Branddefense

SIEM/SOAR

EDR/XDR

Microsoft Defender suite

ISO 27001 Lead Auditor (desirable)

Descripción del empleo

We are looking for an experienced, proactive, and hands-on Senior Information Security & Compliance Executive who can operate across both cybersecurity and Governance, Risk & Compliance (GRC). The successful candidate will help protect business-critical information assets, improve security controls, support regulatory and standards compliance, and work closely with technology, business, legal, audit, and external service providers.

This position is suited to a professional who can translate security risks into clear business actions, actively contribute to day-to-day security operations, and maintain the evidence, governance, and reporting discipline required for audits and management oversight.

Key Responsibilities:

• Operate, monitor, and continuously improve enterprise security controls across endpoints, identities, email, cloud services, applications, and users.
• Actively use and administer relevant Microsoft security capabilities, such as Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Cloud, Microsoft Sentinel, Microsoft Entra ID Protection, Microsoft Purview, and Microsoft Intune security controls.
• Work with endpoint and extended detection and response technologies, including EDR/XDR policy management, alert investigation, incident triage, containment, remediation, and lessons learned.
• Coordinate SOC operations and managed security service providers; monitor service quality, use cases, alert coverage, escalation paths, incident response, and agreed service levels.
• Support the operation and improvement of Trend Micro security solutions used within the environment, including endpoint, server/workload, email, or XDR capabilities as applicable.
• Use Brandefense or similar Digital Risk Protection / External Threat Intelligence platforms to monitor brand abuse, phishing, impersonation, exposed credentials, attack-surface findings, and external cyber risks, and coordinate remediation.
• Strengthen email security through anti-phishing, anti-spoofing, malware protection, safe link/attachment controls, domain authentication controls, investigation processes, and user reporting mechanisms.
• Design and improve user security controls, including MFA, Conditional Access, privileged access, identity risk, security awareness, phishing simulations, and role-based training.
• Develop, maintain, and review information security policies, standards, procedures, control matrices, inventories, risk registers, and supporting evidence.
• Support and coordinate ISO/IEC 27001 Information Security Management System activities, including risk assessments, Statement of Applicability, internal audits, management review inputs, corrective actions, and certification activities.
• Assess compliance with KVKK, GDPR, contractual security obligations, and other applicable requirements in cooperation with Legal and relevant business functions.
• Plan and coordinate vulnerability management, penetration testing, security assessments, remediation tracking, and risk acceptance processes.
• Participate in cyber incident response, root-cause analysis, evidence preservation, crisis coordination, regulatory/contractual assessment, and post-incident improvement actions.
• Embed security and privacy requirements into infrastructure, cloud, application, procurement, supplier, and digital-transformation projects.
• Perform third-party security assessments and monitor supplier risks, remediation plans, and security commitments.
• Prepare clear security KPIs/KRIs, risk summaries, compliance status reports, audit findings, and management presentations.
• Monitor relevant cyber threats, vulnerabilities, attack techniques, regulatory developments, and industry practices, and convert them into prioritized actions.

Requirements:

• Bachelor’s degree in Computer Engineering, Computer Science, Information Systems, Electronics Engineering, or a related discipline.
• Minimum 5 years of relevant experience in information security, cybersecurity operations, security engineering, IT risk, audit, or GRC, with demonstrable hands‑on responsibility.
• Practical experience with Microsoft security products, especially the Microsoft Defender ecosystem; experience with Microsoft Sentinel, Entra ID, Intune, Purview, or Defender for Cloud is highly desirable.
• Hands‑on experience with EDR/XDR, SOC processes, SIEM/SOAR, incident investigation, vulnerability management, email security, and identity/user security.
• Experience with Trend Micro technologies and Brandefense, or comparable enterprise security and digital risk protection platforms.
• Working knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, and security risk‑management practices.
• Practical understanding of KVKK and GDPR requirements and the ability to convert compliance obligations into technical and organizational controls.
• Professional certifications such as ISO 27001 Lead Auditor, CISSP, CISM, or CASP are considered a strong asset.
• Experience supporting audits, collecting evidence, managing findings and corrective actions, and reporting control effectiveness.
• Ability to analyze technical alerts, logs, vulnerabilities, and control gaps while communicating business impact clearly to non‑technical stakeholders.
• Strong documentation, communication, stakeholder management, and project coordination skills, with the ability to communicate security risks effectively to both technical and non‑technical audiences.
• Fluent written and spoken English; strong professional communication skills in Turkish.
• Experience with security risk assessments, incident management, vulnerability management, and security operations.
• Strong analytical thinking, problem‑solving, and project management skills.

Why Join Us:

• Take an active role in shaping and strengthening the organization’s information security and compliance program.
• Work with modern enterprise security technologies in a Microsoft 365 and Azure‑oriented environment.
• Contribute to SOC, threat intelligence, endpoint/XDR, email, identity, cloud, privacy, and security‑awareness initiatives.
• Collaborate with international and cross‑functional teams in a technology‑driven business environment.
• Benefit from professional development opportunities and long‑term career growth.