Istanbul-Based Crypto Asset Custody Internal Auditor

Ceffu; Fatih; Hybrid; TRY 300,000 - 420,000; Full time

Job summary

Ceffu in Istanbul is seeking an experienced Internal Auditor to assess governance, risk management and internal controls for crypto asset services in line with Turkish and global regulatory requirements.

The role requires 5+ years in internal audit, IT risk, or information security controls; a SPK Information Systems Independent Audit Licence is preferred. Hybrid work with occasional travel to group sites is offered.

Qualifications

• Bachelor’s degree in accounting, finance, business administration, information systems, computer engineering or related field.
• Minimum five years of relevant experience in internal audit, information systems audit, control assurance, IT risk, information security controls, regulatory compliance or technology risk.
• Experience within banking, financial services, payment or electronic-money institutions, fintech companies, custody providers or crypto-asset service providers.
• Valid SPK Information Systems Independent Audit Licence, as required under the applicable regulatory framework.
• Strong knowledge of internal audit practices, control-testing methodologies, risk management frameworks and compliance principles.
• Good knowledge of SPK internal-systems requirements, MASAK compliance-program obligations, AML/CFT regulations, FATF Recommendations, Travel Rule requirements, information systems governance and custody operational risks.
• Experience auditing information security, IT governance, access and change management, cloud infrastructure, blockchain platforms, wallet and custody solutions or API security.
• Ability to conduct audits independently, challenge process owners objectively and maintain appropriate professional independence while collaborating with relevant functions.
• Strong analytical, report-writing, stakeholder-management and communication skills in both Turkish and English.
• Highest standards of confidentiality, integrity, professional ethics and discretion when handling sensitive information.
• Candidates must be based in Istanbul and able to work under the company’s hybrid working model.

Responsibilities

• Prepare and execute a risk-based annual internal audit plan covering units, activities and processes.
• Conduct independent audits across operational, financial and regulatory functions.
• Evaluate design and effectiveness of internal controls, risk management and MASAK compliance.
• Audit custody operations and controls for customer asset safeguarding and governance.
• Perform audit testing of information systems governance, security and change management.
• Assess adequacy of policies, procedures and annual reviews.
• Prepare objective internal audit reports for the Board with findings and remediation deadlines.
• Monitor remediation of audit findings and report material findings to the Board.
• Perform regulatory inspections and provide audit evidence upon request.
• Maintain and enhance audit methodologies and stay informed on Turkish crypto regulations.

Skills

Internal audit

Information systems audit

IT risk

Regulatory compliance

Auditing standards

Analytical thinking

Communication (Turkish & English)

Education

Bachelor's degree or higher in accounting/finance/IS/engineering

Job description

Ceffu in Istanbul is seeking an experienced Internal Auditor to assess governance, risk management and internal controls for crypto asset services in line with Turkish and global regulatory requirements.

The role requires 5+ years in internal audit, IT risk, or information security controls; a SPK Information Systems Independent Audit Licence is preferred. Hybrid work with occasional travel to group sites is offered.