Internal Auditor - Digital Assets / Fintech / Crypto

About the role

CeffuCeffu is an institutional-grade digital asset custody platform serving enterprises, hedge funds and financial institutions. It is looking for a highly motivated, detail-oriented Internal Auditor to join its growing team in Istanbul, Turkey. The role evaluates and improves governance, risk management and internal controls in line with local and global regulatory requirements for crypto asset service providers.

Key responsibilities

• Prepare and run a risk-based annual internal audit plan covering units, activities, systems and outsourced or group-supported processes.
• Conduct independent audits of operational, financial and regulatory functions, including SPK, MASAK, information systems, custody, accounting, recordkeeping, outsourcing and conflict-of-interest requirements.
• Evaluate the design and effectiveness of internal control, risk management and MASAK compliance frameworks without taking ownership of them.
• Audit custody operations: customer asset safeguarding, reconciliations, transaction flows, wallet and key-management governance, access rights, incident handling and business continuity.
• Test information systems governance, security, access and change management, backups, outsourcing, logging, asset inventories and TÜBİTAK controls.
• Check that policies are adequate, implemented and reviewed at least annually or after major changes.
• Write objective audit reports for the Board with findings, risk ratings, root causes, recommendations, owners and deadlines, and monitor remediation.
• Support regulatory inspections with complete audit evidence and documentation.
• Maintain audit methodologies and stay informed on Turkish crypto-asset regulations and auditing standards.

Required profile

• Bachelor's degree in accounting, finance, business administration, information systems, computer engineering or a related field.
• At least five years of experience in internal audit, IT audit, control assurance, IT risk, information security controls, regulatory compliance or technology risk.
• Experience in banking, financial services, payment or e-money institutions, fintech, custody providers or crypto-asset service providers.
• Valid SPK Information Systems Independent Audit Licence.
• Based in Istanbul and able to work under a hybrid model.
• Strong analytical, reporting, stakeholder-management and communication skills in Turkish and English, with high confidentiality and ethics.

Required skills

• Knowledge of SPK internal-systems requirements, MASAK compliance, AML/CFT, FATF Recommendations, Travel Rule and information systems governance.
• Experience auditing information security, IT governance, cloud infrastructure, blockchain platforms, wallets, custody solutions and API security.
• Preferred: CIA, CISA, CRMA, ISO 27001 Lead Auditor, CPA or similar; direct crypto-asset audit experience; practical understanding of KYC/AML and data protection; experience with SPK, MASAK, TÜBİTAK or other Turkish regulators.