Internal Auditor - Digital Asset / Fintech / Crypto

Ceffu; Fatih; Hybrid; TRY 300,000 - 420,000; Full time

Job summary

Ceffu in Istanbul is seeking an experienced Internal Auditor to assess governance, risk management and internal controls for crypto asset services in line with Turkish and global regulatory requirements.

The role requires 5+ years in internal audit, IT risk, or information security controls; a SPK Information Systems Independent Audit Licence is preferred. Hybrid work with occasional travel to group sites is offered.

Qualifications

• Bachelor’s degree in accounting, finance, business administration, information systems, computer engineering or related field.
• Minimum five years of relevant experience in internal audit, information systems audit, control assurance, IT risk, information security controls, regulatory compliance or technology risk.
• Experience within banking, financial services, payment or electronic-money institutions, fintech companies, custody providers or crypto-asset service providers.
• Valid SPK Information Systems Independent Audit Licence, as required under the applicable regulatory framework.
• Strong knowledge of internal audit practices, control-testing methodologies, risk management frameworks and compliance principles.
• Good knowledge of SPK internal-systems requirements, MASAK compliance-program obligations, AML/CFT regulations, FATF Recommendations, Travel Rule requirements, information systems governance and custody operational risks.
• Experience auditing information security, IT governance, access and change management, cloud infrastructure, blockchain platforms, wallet and custody solutions or API security.
• Ability to conduct audits independently, challenge process owners objectively and maintain appropriate professional independence while collaborating with relevant functions.
• Strong analytical, report-writing, stakeholder-management and communication skills in both Turkish and English.
• Highest standards of confidentiality, integrity, professional ethics and discretion when handling sensitive information.
• Candidates must be based in Istanbul and able to work under the company’s hybrid working model.

Responsibilities

• Prepare and execute a risk-based annual internal audit plan covering units, activities and processes.
• Conduct independent audits across operational, financial and regulatory functions.
• Evaluate design and effectiveness of internal controls, risk management and MASAK compliance.
• Audit custody operations and controls for customer asset safeguarding and governance.
• Perform audit testing of information systems governance, security and change management.
• Assess adequacy of policies, procedures and annual reviews.
• Prepare objective internal audit reports for the Board with findings and remediation deadlines.
• Monitor remediation of audit findings and report material findings to the Board.
• Perform regulatory inspections and provide audit evidence upon request.
• Maintain and enhance audit methodologies and stay informed on Turkish crypto regulations.

Skills

Internal audit

Information systems audit

IT risk

Regulatory compliance

Auditing standards

Analytical thinking

Communication (Turkish & English)

Education

Bachelor's degree or higher in accounting/finance/IS/engineering

Job description

Ceffu is a leading institutional-grade digital asset custody platform, offering secure, compliant, and scalable solutions for enterprises, hedge funds, and financial institutions. Our mission is to provide cutting-edge security and infrastructure to support the seamless integration of blockchain technology into institutional finance.

Job Summary

We are seeking a highly motivated and detail-oriented Internal Auditor to join our growing team in Turkey. This role will be instrumental in evaluating and improving the effectiveness of governance, risk management, and internal controls in compliance with both local and global regulatory requirements for crypto asset service providers.

Key Responsibilities

• Prepare and execute a risk-based annual internal audit plan covering the company’s units, activities, systems and material outsourced or group-supported processes.
• Conduct independent audits across operational, financial and regulatory functions, including compliance with applicable SPK, MASAK, information systems, internal policy, custody, accounting, recordkeeping, outsourcing and conflict-of-interest requirements.
• Evaluate the design and effectiveness of the company’s internal control, risk management and MASAK compliance frameworks without assuming ownership of, or operational responsibility for, those functions.
• Audit custody operations and controls relating to customer asset safeguarding, reconciliations, transaction flows, wallet and key-management governance, access rights, incident handling and business continuity and recovery arrangements.
• Perform audit testing of information systems governance, information security, access and change management, incident management, backup and recovery, outsourcing, logging, asset inventories and applicable TÜBİTAK controls.
• Assess whether internal policies and procedures remain adequate, are implemented effectively and are reviewed at least annually or following material regulatory, operational or technological changes.
• Prepare objective internal audit reports for the Board, including findings, risk ratings, root causes, recommendations, responsible action owners and remediation deadlines.
• Monitor remediation of audit findings and risk-mitigation actions, and report overdue or material findings to the Board.
• Perform regulatory inspections and provide complete audit evidence and documentation when requested by competent authorities.
• Maintain and enhance internal audit methodologies, tools and documentation; remain informed of Turkish crypto-asset regulations and professional auditing standards; and coordinate with relevant functions solely for evidence collection and remediation monitoring while preserving Internal Audit’s independence.

Requirements

• Bachelor’s degree from a four-year university program in accounting, finance, business administration, information systems, computer engineering or a related field.
• Minimum five years of relevant experience in internal audit, information systems audit, control assurance, IT risk, information security controls, regulatory compliance or technology risk.
• Experience within banking, financial services, payment or electronic-money institutions, fintech companies, custody providers or crypto-asset service providers.
• Valid SPK Information Systems Independent Audit Licence, as required under the applicable regulatory framework.
• Strong knowledge of internal audit practices, control-testing methodologies, risk management frameworks and compliance principles.
• Good knowledge of applicable SPK internal-systems requirements, MASAK compliance-program obligations, AML/CFT regulations, FATF Recommendations, Travel Rule requirements, information systems governance and custody operational risks.
• Experience auditing information security, IT governance, access and change management, cloud infrastructure, blockchain platforms, wallet and custody solutions or API security.
• Ability to conduct audits independently, challenge process owners objectively and maintain appropriate professional independence while collaborating with relevant functions.
• Strong analytical, report-writing, stakeholder-management and communication skills in both Turkish and English.
• Highest standards of confidentiality, integrity, professional ethics and discretion when handling sensitive information.
• Candidates must be based in Istanbul and able to work under the company’s hybrid working model.

Preferred Qualifications

• Professional certification such as CIA, CISA, CRMA, ISO 27001 Lead Auditor, CPA or an equivalent qualification.
• Direct internal audit experience within a crypto-asset service provider, digital-asset custodian, crypto exchange or regulated fintech company.
• Experience auditing blockchain platforms, wallet and key-management solutions, digital-asset custody infrastructure, cloud environments or API security.
• Practical understanding of KYC/AML processes, cybersecurity controls and applicable data-protection and privacy frameworks.
• Experience performing audits, reviews or regulatory inspections involving SPK, MASAK, TÜBİTAK or other Turkish financial supervisory authorities.
• Experience auditing material outsourced or group-supported technology and operational processes.