---
title: 'Senior Technology Risk & Audit Specialist at Picus'
canonical: 'https://feeny.ai/job/senior-technology-risk-audit-specialist-picus-ankara-3v4py6vveevp'
type: 'job'
last_seen: '2026-10-19'
---

# Senior Technology Risk & Audit Specialist at Picus

- **Company:** Picus
- **Location:** Ankara, Turkey
- **Employment:** full-time
- **Work type:** remote
- **Posted:** 2026-10-01
- **Last confirmed live:** 2026-10-19
- **Apply:** https://jobs.lever.co/picus/3025ad8b-60a0-4e4d-8375-5a6954cf1e68

## Job description

## About The Role

Most traditional auditor roles ask you to prove a company is secure at least once a year. At Picus, continuous security validation is our product. We are seeking a Senior Technology Risk & Audit Specialist to strengthen our security governance, risk, and compliance capabilities at scale. In this role, you will run assurance the way our customers run security: continuously, with evidence, and side-by-side dominantly with engineering teams. You will own our global certification programs, act as a strategic advisor to our technology teams, and help govern the AI agents at the heart of our platform. Beyond audit execution, you will act as a strategic advisor to business and technology teams, shaping scalable and risk-aware processes in a cloud-native and AI-driven environment. We want you to be the person teams come to before they build, not after.

## What You Bring

6+ years of hands-on experience in IT audit, information security, risk and compliance management, preferably within a SaaS, cloud-native, or fast-growing technology environment. Product Security & Secure SDLC: Proven ability to evaluate software engineering processes from an audit and assurance perspective, covering CI/CD pipeline controls, secure development practices, vulnerability management, software supply chain security, and SBOM governance. Technical Fluency: You understand how cloud infrastructure, IAM, SIEM, and CI/CD pipelines actually work, allowing you to collaborate effectively with engineers in their own language. Framework Expertise: Deep, hands-on experience with ISO/IEC standards (particularly 27001 and 27701), SOC 2 Type 2 and NIST frameworks, including preparation, audit coordination, and evidence management. Strategic Execution: The ability to turn international standards into practical, scalable processes that enable innovation rather than slowing it down. Regulatory Knowledge: Practical understanding of international privacy regulations (e.g., GDPR, KVKK, CCPA) and third-party risk management (TPRM) practices. Communication & Influence: Clear written and spoken English. You can write policies that are easy to understand and advise cross-functional stakeholders, driving control improvements without relying purely on formal authority. ISO/IEC 27001, 22301, 27701, 20000-1 and 42001 LA certifications (nice to have), ISACA certifications such as CISA (most preferred), CISM, or CRISC, AAIA, AAISM, or AAIR (nice to have), Hands-on experience with SOC 2, NIST, and CSA STAR reporting frameworks (nice to have), Last but not least, we expect you to bring the team spirit that we value the most!

## What You'll Do

Plan and execute risk-based IT and internal audits, with a strong focus on secure SDLC, software engineering processes, cloud infrastructure, and AI security domains, Evaluate and enhance the effectiveness of security and governance controls, driving continuous improvement across policies and processes, Manage audit and security vulnerability findings end-to-end, ensuring sustainable remediation and measurable control improvements, Lead and oversee global compliance programs (ISO/IEC 27001, 22301, 27701, 20000-1, SOC 2, NIST CSF, CSA STAR) to maintain continuous audit readiness, Actively support the Third-Party Risk Management (TPRM) program by participating in SaaS security assessments and vendor due diligence, Define and track key audit and compliance metrics, reporting insights to leadership and relevant stakeholders, Assess the risk and privacy impact of emerging technologies (AI, ML, and automation), guiding engineering teams on secure adoption practices.

## About Picus

Picus Security is an exposure validation company. One platform proves what attackers can exploit and what your defenses stop, turning every exposure into a defensible decision, autonomously and at the machine speed today's AI threats demand.

Picus validates attack surfaces, exposures, and security controls as one continuous loop: validate, decide, fix, re-validate. Instead of ranking findings by severity score, Picus proves which exposures are genuinely exploitable in your environment, including the business-critical, restricted, and air-gapped assets a live exploit can never safely touch, so teams act on what truly matters and resolve each exposure into a clear call to patch, mitigate, monitor, or accept with evidence.

The Picus Platform spans Autonomous Penetration Testing, Exposure Validation, and Breach and Attack Simulation, unified by Picus Swarm, a swarm of AI agents that runs the whole validation loop continuously. It reaches across on-prem, hybrid cloud, and endpoint environments, with 75+ integrations that ingest from scanners like Tenable and Wiz and operationalize through your EDR, SIEM, firewall, and ticketing tools.

The pioneer of Breach and Attack Simulation, Picus proves and improves the security controls you already own, doubling control effectiveness within three months. Picus holds a 95% recommendation rate, 4.9 on G2, and 4.8 on Gartner Peer Insights, and is the #1 Leader on Frost Radar for Automated Security Validation.

Working at Picus Fascinating work - a chance to shape and lead an exciting, fast-growing cybersecurity segment. Security Validation is a concept that helps organizations evaluate their security posture in a continuous, automated, and repeatable way. This approach allows for the identification of imminent threats, provides recommended actions, and produces valuable metrics about cyber-risk levels. Unlimited opportunity! We are growing. At Picus, you'll be provided with as much responsibility as you can handle - new career development opportunities constantly arise given our rate of growth. Global exposure - Get a lot of experience working not only in a fast-growing startup but also interacting with customers all around the world. Be part of a global remote team that is taking on Exposure Validation and a growing market segment. We are an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to age, sex, race, color, national origin, religious belief, gender or gender reassignment, sexual orientation, marriage or civil partnership, pregnancy and maternity, disability, protected veteran status, or any other characteristic protected by International law. Upon conditional offer of employment, candidates are required to complete reference and identity checks in line with local labor laws and as per the Company’s employment policy. Picus Security processes candidates' personal data in accordance with applicable data protection laws. For detailed information on how your personal data is processed during the recruitment process, please review ourCandidate Privacy Notice.

## About Picus

## Company Overview
- **One-liner**: Picus Security is a cybersecurity company that pioneered Breach and Attack Simulation (BAS) and now offers an Autonomous Exposure Validation Platform to continuously validate what attackers can actually exploit.
- **Entity Type**: Private (Series C, $80M total funding per company; $104M per LinkedIn – conflicting reports)
- **Headquarters**: San Francisco, California, United States
- **Founded**: 2013
- **Founders**: H. Alper Memis (Co-founder & CEO), Suleyman Ozarslan (Co-founder, VP of Picus Labs)

## Core Business
- Primary industry: Computer and Network Security (cybersecurity)
- Target customers: B2B, enterprise organizations seeking to validate security controls and reduce cyber risk
- Mission: Reduce cyber risk through continuous security validation, turning every exposure into a defensible decision.

## Products & Services
- **Picus Autonomous Exposure Validation Platform**: A unified platform combining exposure assessment, security control validation, and adversarial exposure validation. It simulates real attack techniques across network, endpoint, and cloud to measure control performance and prioritize fixes.
- **Picus Swarm™**: A team of specialized AI agents that converge automated penetration testing, exposure validation, and breach‑and‑attack simulation into one autonomous, context‑aware loop (tunable from manual to fully autonomous).

## Market Standing
- **Valuation/Market Cap**: Not disclosed (private)
- **Key Metric**: Annual Revenue of $85M (LinkedIn estimate); Total Funding of $80M (company) or $104M (LinkedIn – conflicting reports)
- **Notable Investors/Partners**: Riverwood Capital (led Series C), Turkven (led Series B), Bek Ventures, Earlybird Digital East Fund, Mastercard
- **Growth Signals**: 246 employees (+15.9% YoY), 500+ customers, recognized by Gartner Peer Insights with a 98% willingness to recommend (highest in Adversarial Exposure Validation category), global expansion across 15+ countries

## Competitive Advantages
- First mover in Breach and Attack Simulation (BAS) since 2013
- Only company that brings together Automated Penetration Testing, BAS, and Rule Validation in an open platform
- Evidence‑based prioritization reduces patch backlogs by 86% and MTTR from 74 to 14 days
- High customer satisfaction and industry recognition (Gartner Cool Vendor, Peer Insights leader)

## Strategic Focus
- Expanding AI‑driven autonomous validation capabilities (Picus Swarm)
- Continuing global growth (offices in US, Turkey, UK, and presence in Middle East, Asia, Europe)
- Modernizing security budgets and raising ROI on existing security tools
- Deprioritizing low‑value patching by focusing on what is actually exploitable

## Why Work Here
- Culture: “Strong sense of belonging where uniqueness enhances team effectiveness” – global, collaborative, innovation‑driven
- Remote/hybrid policy: Remote work is offered (“Flexible location, same impact”); some roles are hybrid (e.g., Ankara, Turkey)
- Benefits: Stock options, annual leave, competitive local packages
- Employer rating: 4.4/5.0 on LinkedIn (87 reviews), with 4.2 for work‑life balance, 4.3 for compensation and culture
- Engineering culture: Emphasis on building new things, pushing out of comfort zone, and taking on challenges as a team

## Sources
1. [picussecurity.com](https://www.picussecurity.com/)
2. [picussecurity.com/about-us](https://www.picussecurity.com/about-us)
3. [picussecurity.com/careers](https://www.picussecurity.com/careers-at-picus)
4. [jobs.lever.co/picus](https://jobs.lever.co/picus)
5. [linkedin.com/company/picus-security](https://www.linkedin.com/company/picus-security)

## Other roles at Picus

- [Channel Account Manager - Central](https://feeny.ai/job/channel-account-manager-central-picus-chicago-a17cprdct8ba) — Chicago, IL
- [Customer Success Architect](https://feeny.ai/job/customer-success-architect-picus-united-states-ns2x2vmxsca6) — United States
- [Solution Architect](https://feeny.ai/job/solution-architect-picus-ankara-c497fe9ma63t) — Ankara, Turkey
- [Sales Director - West & Central](https://feeny.ai/job/sales-director-west-central-picus-texas-b2wn1dgr1dgn) — Texas, United States
- [Strategic Account Executive - West & Central](https://feeny.ai/job/strategic-account-executive-west-central-picus-texas-g20fab414x51) — Texas, United States
- [Channel Account Manager - West](https://feeny.ai/job/channel-account-manager-west-picus-san-francisco-5523vfwc1bd9) — San Francisco, CA
- [Sales Director - Public Sector](https://feeny.ai/job/sales-director-public-sector-picus-washington-ng6j3eqjarf9) — Washington, DC
- [Enterprise Account Executive - North West](https://feeny.ai/job/enterprise-account-executive-north-west-picus-san-francisco-adtp7yyfvksd) — San Francisco, CA
- [Principal Product Marketing Manager, Strategy & Positioning](https://feeny.ai/job/principal-product-marketing-manager-strategy-positioning-picus-united-states-ar8tzyvsd9jn) — United States
- [Senior Product Marketing Manager](https://feeny.ai/job/senior-product-marketing-manager-picus-united-states-x4hrevh6s6mt) — United States