Information Security Executive (Cybersecurity & GRC)

About the role

An experienced, proactive and hands-on Senior Information Security & Compliance Executive is sought, covering both cybersecurity and Governance, Risk & Compliance (GRC). The role protects business-critical information assets, improves security controls, supports regulatory and standards compliance, and works closely with technology, business, legal, audit and external service providers. It suits someone who turns security risks into clear business actions and keeps the evidence and reporting discipline needed for audits.

Key responsibilities

• Monitor and improve security controls across endpoints, identities, email, cloud, applications and users, using Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Cloud, Microsoft Sentinel, Microsoft Entra ID Protection, Microsoft Purview and Microsoft Intune.
• Manage EDR/XDR policies, investigate alerts, triage incidents, contain and remediate, and coordinate SOC operations and managed security service providers.
• Support Trend Micro solutions and use Brandefense or similar platforms to monitor brand abuse, phishing, exposed credentials and external threats.
• Strengthen email security and design user controls such as MFA, Conditional Access, privileged access, security awareness and phishing simulations.
• Maintain security policies, standards, control matrices, risk registers and evidence, and support ISO/IEC 27001 activities.
• Assess compliance with KVKK, GDPR and contractual obligations, and plan vulnerability management, penetration testing and security assessments.
• Participate in incident response, embed security into projects, run third-party assessments, and prepare KPIs, risk summaries and audit reports.

Required profile

• Bachelor's degree in Computer Engineering, Computer Science, Information Systems, Electronics Engineering or a related field.
• At least 5 years of hands-on experience in information security, cybersecurity operations, security engineering, IT risk, audit or GRC.
• Fluent written and spoken English; strong professional communication in Turkish.
• Experience supporting audits, evidence collection, finding management and reporting control effectiveness.

Required skills

• Practical experience with Microsoft Defender, Sentinel, Entra ID, Intune, Purview or Defender for Cloud.
• Hands-on EDR/XDR, SOC processes, SIEM/SOAR, incident investigation, vulnerability management and email security.
• Knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, KVKK and GDPR.
• Certifications such as ISO 27001 Lead Auditor, CISSP, CISM or CASP are a strong asset.

What we offer

• An active role in shaping the information security and compliance program.
• Work in a Microsoft 365 and Azure-oriented environment with SOC, threat intelligence and endpoint/XDR initiatives.
• Collaboration with international and cross-functional teams.
• Professional development opportunities and long-term career growth.