iyzico is a Turkish fintech company founded in 2013 that processes millions of transactions across over 120,000 websites. Acquired by PayU in 2019, it builds online payment infrastructure and AI-based payment technologies for the e-commerce sector. The attack surface here is significant: payment credentials, transaction flows, consumer PII, and merchant data all move through systems that handle fraud detection, dispute resolution, and real-time authorization.
Security teams at iyzico operate in a domain where the threat model includes credential stuffing against merchant accounts, payment fraud at scale, API abuse targeting transaction endpoints, and data exfiltration from systems storing sensitive financial information. The company's products - iyzico Buyer Protection and iyzico Protected Shopping - introduce additional surfaces: mobile app interfaces, 24/7 support channels, and cancellation/return workflows that must be hardened against social engineering and account takeover vectors.
Technical domains center on artificial intelligence and payment technologies, meaning security engineering likely intersects with ML model integrity, securing data pipelines that feed fraud detection systems, and maintaining PCI DSS compliance across a high-throughput payment stack. The team operates primarily in Turkey, serving a domestic e-commerce market at meaningful scale - over 120,000 merchant websites represent a broad and varied integration landscape with differing security postures on the other end.
