Internal Control Officer (Digital Assets / Crypto)

About the role

CeffuCeffu is an institutional-grade digital asset custody platform serving enterprises, hedge funds and financial institutions. It is hiring an Internal Control Officer to support and work with the Board in Turkey, focusing on monitoring internal processes, controls and compliance and reporting issues so that regulatory adherence and operational integrity are maintained. The role supports the company's risk management and audit functions in line with Turkish regulations for crypto asset service providers.

Key responsibilities

• Prepare and execute risk-based annual and periodic internal control plans approved by the responsible non-executive board member or the Board, and report findings and recommendations to Senior Management and governance bodies.
• Perform continuous control activities across custody operations, customer asset safeguarding, reconciliations, transaction flows, whitelisting, onboarding, access rights, incident management, recordkeeping and reporting.
• Test controls required under SPK, MASAK, information systems and internal governance rules, including authority matrices, approval workflows and segregation of duties.
• Assess the adequacy of controls covering operational, financial, compliance, technology, cybersecurity and AML/CFT risks, especially in high-risk areas.
• Review information systems control evidence with the CISO and Information Systems Specialist, independently of control implementation.
• Review MASAK process controls such as customer due diligence, sanctions and wallet screening, without replacing the MASAK Compliance Officer.
• Lead the design and implementation of controls for new products, digital assets, blockchain services, technology initiatives and material business changes.
• Identify and classify control deficiencies, track corrective actions to completion, and coordinate internal and external control reviews and regulatory inspections.
• Escalate matters that may threaten customer assets to the responsible board member and the Board, and maintain the internal control framework and governance documentation.

Required profile

• Bachelor's degree in accounting, finance, business administration, information systems, computer engineering or a related field.
• 3-5 years of experience in internal control, internal audit, compliance monitoring, operational risk or information systems control.
• Istanbul-based, able to work under a hybrid model; professional Turkish and English.
• Preferred: experience in a regulated financial institution, payment or custody provider, fintech or crypto-asset service provider, and knowledge of blockchain and digital-asset custody.

Required skills

• Strong understanding of COSO, the Three Lines Model and risk-based control methodologies.
• Good knowledge of SPK and MASAK requirements, AML/CFT legislation, FATF Recommendations and segregation of duties.
• Process mapping, risk assessment, control design and testing, audit-evidence preparation and governance reporting.
• Familiarity with COBIT and ISO 27001; certifications such as CIA, CISA, CCSA, CRISC, CAMS or ISO 27001 Lead Auditor are an advantage.