Information Security Manager (Focus on risk and compliance | Hybrid in Ataşehir)

Ticimax; Fatih; Hybrid; TRY 520,000 - 760,000; Full time

Job summary

Ticimax, a Turkey-based e-commerce platform, seeks a Risk, Compliance, and Information Security Manager to secure our software products and ensure regulatory compliance. You will oversee PCI DSS and ISO 27001, manage vulnerability assessments, and coordinate audits.

The role requires hands-on security testing, strong documentation, and English proficiency. Onboarding starts in our Kozyatağı Ataşehir office with hybrid work twice weekly thereafter.

Qualifications

• Minimum 3 years of experience as an Information Security Manager or similar role.
• Solid understanding of PCI DSS and ISO 27001 frameworks.
• Hands-on experience with vulnerability scanning tools (Nessus, Qualys) and SIEM platforms.
• Familiarity with GRC systems and compliance reporting.
• Strong documentation, audit preparation, and analytical skills.
• Full professional proficiency in English.

Responsibilities

• Manage PCI DSS (Service Provider Level 1) and ISO 27001 compliance and certification processes.
• Analyze security vulnerabilities and propose effective technical and organizational controls.
• Plan and coordinate internal and external penetration tests, and follow up on remediation.
• Perform regular vulnerability assessments using tools such as Nessus, Qualys, etc.
• Conduct risk assessments and prepare corrective action plans.
• Use SIEM and GRC tools for monitoring and reporting.
• Prepare for audits and manage relevant documentation.
• Raise awareness across the organization on compliance and security best practices.

Skills

InfoSec Mgmt

PCI DSS

ISO 27001

Nessus

Qualys

SIEM

GRC

Documentation

Audit readiness

English

Tools

SIEM platforms

GRC systems

Job description

About us

Ticimax is a Turkey-based e-commerce platform founded in 2005. It helps businesses create and manage online stores without needing advanced technical knowledge. It offers features such as product and stock management, payment and shipping integrations, marketplace connections, SEO tools, and AI-powered content creation. Ticimax also supports international sales through multi-language and multi-currency options.

Mission & Core Purpose

As a Risk, Compliance, and Information Security Manager, you will ensure our software products are secure and compliant with relevant regulations. This role will manage penetration testing, vulnerability assessment, and oversee certification processes such asPCI DSSandISO 27001.

Key Responsibilities

• Manage PCI DSS (Service Provider Level 1) and ISO 27001 compliance and certification processes.
• Analyze security vulnerabilities and propose effective technical and organizational controls.
• Plan and coordinate internal and external penetration tests, and follow up on remediation.
• Perform regular vulnerability assessments using tools such as Nessus, Qualys, etc.
• Conduct risk assessments and prepare corrective action plans.
• Use SIEM and GRC tools for monitoring and reporting.
• Prepare for audits and manage relevant documentation.
• Raise awareness across the organization on compliance and security best practices.

Experience & Skills

• At least 3 years of experience as an Information Security Manager (or in another similar role).
• Solid understanding of PCI DSS and ISO 42001 frameworks.
• Hands-on experience with vulnerability scanning tools (e.g., Nessus, Qualys) and SIEM platforms.
• Familiarity with GRC systems and compliance reporting.
• Strong documentation, audit preparation, and analytical skills.
• Full professional proficiency in English.

Your Profile

• Experience in secure software development practices.
• Familiarity with remediation follow-ups after penetration tests.
• Relevant certifications (e.g., OSCP, CEH, ISO 27001 Lead Auditor, CISA).

Location

For the first two months, we would expect the onboarding to be carried out in person at our office in Kozyatağı Ataşehir Allianz Tower. Afterwards, tasks can be carried out in a hybrid mode, where you would be asked to attend the office twice per week.