Senior Security Engineer 'Information Security Architecture'

Yapı Kredi Teknoloji; İzmit; Hybrid; TRY 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid work model

Koç Group Community offices

Structured technology career path

BizClub & KoçAilem privileges

Company-retirement insurance

Birthday off day

Job summary

Yapı Kredi Technology is seeking a skilled security professional to ensure regulatory compliance across SDLC/IDLC projects and to lead threat modelling and risk management activities. You will guide security decisions, document design security considerations, and ensure software supply chain integrity.

The role requires strong English, collaboration skills, and 3+ years in related security areas with a total IT experience of 9+ years, in a hybrid work environment within Turkey.

Qualifications

• Bachelor’s degree in Computer, Electronics, Communication Engineering or relevant fields.
• Minimum 3 years of experience in project management, Agile approaches, DevSecOps; 9+ years IT total.
• Solid knowledge of threat modelling process and tools.
• Knowledge of crypto, blockchain, AI fields preferred.
• Strong awareness of security regulations (BDDK, PCI DSS, PCI PIN, Swift Security Framework, KVKK, OWASP, OWASP SAMM) and best practices (NIST, ISO, CIS).
• Certifications such as CISA, CISM, CISSP preferred.
• Strong English written and spoken skills; good interpersonal abilities.

Responsibilities

• Ensure security compliance requirements in SDLC/IDLC projects (BDDK, PCI DSS, PCI PIN, Swift, KVKK, CIS).
• Evaluate security requirements and risks; define preventive/detective controls.
• Perform threat assessments at the project level.
• Provide proactive security guidance in design processes.
• Facilitate informed security decisions through risk management and timely actions.
• Document key security decisions across development phases.
• Define major activities, milestones, and security planning.
• Ensure supply chain and software security assurance.

Skills

Threat modelling

Security governance

Risk assessment

Security architecture

Cloud security

Blockchain knowledge

Crypto knowledge

Excellent communication

English (written and spoken)

Team collaboration

Education

Bachelor’s degree in Computer/Electronics/Communication Engineering

Tools

Threat modelling tools

PCI DSS frameworks

NIST/ISO/CIS security standards

Job description

Yapı Kredi Technology is a technology company that produces innovative, high quality, and high value-added products and solutions in the finance sector. With more than 2,000 employees, it aims to create products that will shape the sector for Yapı Kredi Bank and to be the undisputed leader in the field of technology by using modern architectural systems and cloud technologies. It also contributes to the development of new and exemplary products for the sector by using natural language processing, machine learning, artificial intelligence, and data mining technologies with its R&D team.

Who We Are:

At Yapı Kredi Technology, we research with passion, wonder as we learn, and implement innovations that shape the future together. We take responsibility from the first day with our expert colleagues and work with all our strength for pioneering applications. We make quick decisions and take action. We quickly adapt to innovations and changes.

What Do We Offer:

• Opportunity to work in hybrid model
• Opportunity to work in Koç Group Community Companies' offices
• Career development opportunities in a structured technology career path
• Opportunity to benefit from BizClub and KoçAilem privileges exclusive to Yapı Kredi Technology employees
• Company-contributed individual retirement insurance
• Birthday off day.

Qualifications:

• Bachelor’s degree in Computer, Electronics, Communication Engineering or relevant fields
• Experience in Banking and Information Security Domains
• Minimum 3 years of experience on related areas ( Project management, Agile approaches, DevSecOps), 9+ years of IT experience in total
• Solid knowledge of threat modelling process & tools
• Knowledge of crypto, blockchain, AI fields is preferred.
• Solid knowledge of the regulations (BDDK, PCI DSS, PCI PIN, Swift Security Framework, KVKK, OWASP, OWASP SAMM ) and best security practices (NIST, ISO,CIS)
• Certification(s) including but not limited to (CISA, CISM , CISSP) is preferred.
• Good command of English both written and spoken
• Openness to the continuous acquisition of new skills and competencies
• Team player who takes pride in, and facilitates the sharing of knowledge
• Ability to work creatively and analytically in a problem-solving environment
• Excellent communication (written and oral) and interpersonal skills
• Builds relationships and communicates effectively in order to positively influence peers and other stakeholders

Job Description:

• Ensure security compliance requirements, laws and regulations (BDDK, PCI DSS, PCI PIN, Swift, KVKK, CIS) in SDLC and IDLC Projects
• Evaluate security requirements and risks, to determine preventive and detective security measures to be taken within the scope of the project
• Perform threat assessment (TA) practice to identify project-level security risks
• Perform proactive security guidance into the software and infrastructure design process
• Facilitation of informed security leads decision making through comprehensive risk management in a timely manner before production
• Documentation of important security decisions made during development, ensuring management that security was fully considered during all phases
• Define major activities and milestones
• Initiate Security Activity Planning and key security milestones including time frames
• Ensuring all key leads have a common understanding, including security implications, considerations, and requirements
• Develop Security part for project documents
• Ensuring supply chain and software security assurance

Our recruitment process for all positions typically encompasses technical interviews, director assessments, competency evaluations, and personality tests. We will extend our offer to candidates who have successfully completed a positive evaluation process.