About
Open to Security Engineer roles
Get in touchI am a Security Engineer who designs, builds, and operates security controls end to end — from the code that ships to the infrastructure it runs on and the telemetry that watches it.
My hands-on foundation is Detection & Response: operating SIEM, EDR/XDR, and DLP platforms in enterprise and banking environments, writing detections, hunting threats with open-source tools, and supporting Incident Response and digital forensics. Around that core I work across the wider security stack:
- Application Security & DevSecOps — SAST, container and IaC scanning gates in CI/CD (Semgrep, Trivy, Checkov), OWASP Top 10 and API testing.
- Cloud & Infrastructure Security — Linux and Windows hardening, network segmentation, Active Directory, Kubernetes, GCP and Cloudflare serverless platforms.
- Vulnerability Management & Offensive Testing — exposure discovery with Nmap, OpenVAS, and Nuclei, risk-based prioritization, and exploit validation.
- Identity, Data & AI Security — IAM architectures, DLP, and research on Model Context Protocol (MCP) and agentic AI threats.
A background in software development and offensive security lets me look at systems through an adversary's lens, and I prefer to turn what I learn into code: open-source tools, automated pipelines, and repeatable playbooks.
On the academic front, I am pursuing an M.Sc. in Software Engineering, focusing my graduate research and thesis on Software Security and secure code development practices.
Experience
Cyber Security Engineer
@ Arma Bilisim- Delivered enterprise SIEM, XDR, EPP, and DLP deployments and pre-sales PoCs; tuned detection rules and onboarded telemetry.
- Led threat hunting engagements with open-source tooling and custom detection logic mapped to MITRE ATT&CK.
- Conducted OpenVAS and Nmap vulnerability assessments; drove end-to-end incident response, root-cause analysis, and containment.
Network Security
XDR
SIEM
EPP
DLP
Threat Hunting
Incident Response
Forensics
Cyber Security Specialist
@ Garanti BBVA Teknoloji- Monitored 24/7 high-availability banking telemetry with Splunk and XDR; triaged Tier-2 incidents and coordinated active containment.
- Responded to active threats by isolating compromised endpoints, blocking malicious IPs/domains, and correlating complex events.
- Built Python and Bash log parsers for multi-source event streams, speeding up manual triage of active alerts.
Splunk
SIEM
XDR
Threat Detection
Forensics
Incident Response
Cyber Security Analyst
@ ADEO Cyber Security- Investigated and resolved 24/7 MDR alerts across client fleets using CrowdStrike Falcon, Defender XDR, Cortex XDR, and SentinelOne.
- Implemented and tuned DLP and EDR solutions to detect and prevent unauthorized data exfiltration.
- Performed log analysis and vulnerability assessments, prioritizing remediation with CVSS scoring and MITRE ATT&CK.
CrowdStrike Falcon
Cortex XDR
Defender XDR
SentinelOne
Wazuh
Sentinel
DLP
EDR
Information Technology Intern
@ Consulta- Supported IT infrastructure operations, Active Directory provisioning, Microsoft 365 administration, and Linux server hardening.
- Wrote Python and Bash scripts to parse and archive event logs, automating weekly operational health reports.
- Contributed to security awareness and documentation.
Help Desk Support
System Administration
Linux Hardening
Active Directory
Microsoft 365
Security Awareness
Cyber Security Intern
@ BG-Tek Information Security Technologies- Performed basic penetration testing on web applications and network systems.
- Assisted in vulnerability assessments and security reporting.
- Gained hands-on experience in system safety and data center environments.
Web Application Security
Network Security
Penetration Testing
Vulnerability Assessment
Achievements & Research
- IEEE HPEC 2026 — paper and poster on Graph Neural Network inference performance and energy efficiency on the Intel Core Ultra NPU (project).
- Agentic AI security research — threat taxonomy and IEEE-format paper on Model Context Protocol risks such as prompt injection and tool poisoning (project).
- Threat hunting write-ups — a 10-part LetsDefend series covering firewalls, SIEM, EDR, Sysmon, DNS, WAF, IDS/IPS, deception, email security, and CTI (write-ups).
- Technical writing — 30+ bilingual (TR/EN) articles on detection engineering, cloud-native hardening, DevSecOps, and AI security (blog).
- Open-source web books — two Turkish technical books built with Astro Starlight: Siber Güvenlik Operasyonları (14 domains, 49 topics mapped to NIST, ISO 27001, and MITRE ATT&CK) and Ağ Yönetimi ve Güvenliği (12 chapters on network architecture, packet-level attack detection, C2 hunting, and network forensics).
Volunteering
President of Community & OWASP Student Representative
@ BTU Informatics Community & OWASP BTU- Led the BTU Informatics Community at Bursa Technical University, growing it to over 500 active members.
- Organized large-scale technical training sessions and "Security Day" events to raise cybersecurity awareness across the campus as an OWASP Student Representative.
- Networked with industry leaders to coordinate professional webinars, hands-on workshops, and technical site visits for student career development.
- Represented the community in university administrative processes, managing budget allocation and administrative collaborations.
Core Member
@ PwnLab.Me- Published technical blog posts and CTF (Capture The Flag) walkthroughs for the PwnLab.Me cybersecurity community.
- Supported community growth strategies and provided technical mentorship through Discord and other social channels.
- Contributed to the security ecosystem by conducting in-depth analyses of modern attack vectors and network security implementations.
Scout Leader & Search and Rescue Volunteer
@ TİFAKE (Scouting and Guiding Federation of Turkey)- Actively participated in rescue and humanitarian aid operations within TİFAKE in coordination with AFAD.
- Deployed for search and rescue during the February 6th earthquakes and the Bozkurt flood disaster.
- Conducted forest fire response in Ovacik and managed humanitarian logistics in various disaster zones.
- Maintained leadership roles in scouting, focusing on youth physical and social development.
Technical Expertise & Skills
Detection & Response
- SIEM & Detections Splunk, Microsoft Sentinel, Elastic, and Wazuh; correlation rules and detections mapped to MITRE ATT&CK.
- Endpoint Protection (EDR & XDR) Endpoint defense with SentinelOne, Microsoft Defender XDR, Cortex XDR, and CrowdStrike Falcon.
- Threat Hunting Proactive threat hunting using open-source tools and SIEM correlation rules.
- Incident Response & Forensics Incident handling, in-depth log investigation, root-cause analysis, and digital forensics.
- Network Defense & Traffic Analysis Enterprise firewalls, deep packet inspection (DPI), and traffic analysis with Wireshark and Zeek.
AppSec & DevSecOps
- DevSecOps & CI/CD Automated security gates via GitHub Actions, Semgrep (SAST), Trivy (container scanning), and Checkov.
- Web App & API Security Web and API penetration testing with Burp Suite and OWASP ZAP; OWASP Top 10 audits.
- Supply Chain & AI Security Research Model Context Protocol (MCP) security analysis, autonomous agent threat modeling, and NPM supply chain research.
- Backend & Serverless Go, Node.js/Express, Python, and Cloudflare Serverless (Workers, D1, R2, Hono) architectures.
- Scripting & Automation Custom security tooling and workflow automation with Python, PowerShell, and Bash.
Cloud & Infrastructure
- Containers & Kubernetes Docker, Proxmox VE, and RKE2 Kubernetes with network-policy, RBAC, and pod-security hardening.
- Infrastructure as Code (IaC) Server configuration automation and infrastructure as code with Ansible and Terraform.
- Identity & Directory Services Active Directory, Samba 4 AD, and Authentik for SSO and MFA.
- Linux Server Administration End-to-end administration and hardening of Ubuntu, Debian, RHEL, and Pardus systems.
- Enterprise Networking & Edge Network segmentation, VLANs, TCP/IP, DNS/DHCP, Nginx reverse proxies, and Cloudflare Tunnels.
Offensive Security & Vulnerability Management
- Vulnerability Assessment Vulnerability and port scanning with OpenVAS, Nuclei, and Nmap.
- Vulnerability Management Risk-based prioritization with CVSS, security assessment, and remediation tracking.
- Exploitation & Verification Vulnerability validation, proof-of-concept, and exploitation with Metasploit Framework.
- Security Orchestration & Phishing Vantage and Gophish for enterprise phishing simulations and tool orchestration.
Education
- M.Sc. in Software Engineering | Karabük University (2025 – 2027)
- Thesis / Research Focus: Software Security.
- B.Sc. in Computer Engineering | Bursa Technical University (2019 – 2024)
- English preparatory year: 2019 – 2020.
- Focus: Software development and application security.