Security Architect

Who We Are?

We are the technology leader of the aviation industry in Türkiye — designing the future of airline retailing. We are an innovative and visionary team that focuses on creativity, collaboration, and engineering excellence. We design and develop next-generation airline retailing platforms where people, technology, and data come together to create seamless digital travel experiences.

Our work focuses on building a unified digital ecosystem for offers, orders, payments, and services — aligned with the IATA MAR (Modern Airline Retailing) vision. We develop technologies in digital identity, payment orchestration, offer & order management, personalization, and data-driven decision systems — forming the backbone of modern airline retailing.

With offices in Istanbul, Ankara, and Izmir and a team of over 1800 professionals, we are shaping the future of travel today. If you want to drive the digital transformation of airline retailing, join us.

About the Team

You will join a fast-growing technology team dedicated to realizing the IATA MAR vision. The team builds solutions based on the OOSD (Offer, Order, Settle, Deliver) domain model using API-first, event-driven, and cloud-native technologies. By adopting domain-driven architecture, we enable agile product teams to deliver scalable, modular, and interoperable systems.

About the Job

As a Security Architect, you will design secure architectures, implement IAM, Zero Trust, and DevSecOps principles across systems, and lead security governance activities.

Responsibilities:

• Design end-to-end security architectures across application, network, data, and cloud layers
• Implement IAM solutions (e.g., Keycloak or equivalent) and access control mechanisms
• Apply Zero Trust principles, mTLS, WAF, Vault and encryption strategies
• Perform threat modeling using Threat Modeling Manifesto principles and apply models such as STRIDE, LINDDUN, CIA, DIE, and PLOT4ai
• Produce modeling diagrams (DFDs, Attack Trees, Sequence Diagrams, etc.)
• Integrate DevSecOps into CI/CD pipelines; automate security scans using tools like OWASP ZAP, Trivy, Snyk or equivalents
• Implement IaC security controls and policy enforcement (e.g., OPA Gatekeeper, Terraform scanning or equivalents)
• Ensure compliance with standards and regulations (ISO 27001, PCI-DSS, GDPR/KVKK)
• Lead penetration testing, risk assessments, and security audits
• Design and coordinate incident response processes and run tabletop/exercise scenarios
• Promote secure-by-design principles and mentor development teams on secure coding practices

Qualifications:

• Minimum 7 years of experience, preferably 10+ years in security architecture or cybersecurity
• Deep expertise in cloud security and IAM solutions across public cloud and on-prem/hybrid environments
• Proficiency in threat modeling and producing modeling diagrams (STRIDE, LINDDUN, CIA, DIE, PLOT4ai)
• Practical experience with DevSecOps tooling and automation in CI/CD pipelines
• Hands-on knowledge of IaC security checks, policy-as-code, and automated scanning workflows
• Strong understanding of security and compliance standards (ISO 27001, PCI-DSS, GDPR/KVKK)
• Experience in penetration testing coordination, risk management, and incident response orchestration
• Strong leadership, stakeholder communication, and governance capabilities
• Security certifications are a plus (e.g., CISSP, CISM, OSCP, CEH)

Example project experience (optional, preferred):
Experience designing security architecture for large-scale, multi-domain systems (e.g., major financial platforms, telecom infrastructures, or airline ecosystems) is preferred.

Note:
Experience in large-scale, multi-domain transformation projects is considered an asset.

Benefits Of Working With Us:

In addition to having the opportunity to grow and be challenged, and to be part of a life, our people enjoy a range of rewarding benefits:

• Flexible working arrangements, generous personal, parental and cultural leave
• Competitive remuneration
• Free and subsidized health and wellbeing services
• Discounts on a wide range of products and services
• Career development opportunities
• A buddy who will guide and accompany you during your onboarding process
• A great number of online courses and technical trainings that will support your development
• Personalized development plan for you
• Using CED & Pass Flight for travelling experience with your family
• Support payment for childcare

Be Yourself

We value the unique backgrounds, experiences and contributions that each person brings to our team and encourage and celebrate diversity.

If you would like to get to know more about Turkish Airlines Technology, please follow us on Instagram and LinkedIn;