Security Engineer
Security Engineer who designs, builds, and automates defenses end to end — from detection and incident response to application, cloud, and infrastructure security. Open to Security Engineer roles.
An open, AI-assisted SecOps platform on the Basic-licensed Elastic Stack: Logstash/Beats ingestion, 30 detection rules, alert-to-incident correlation over NATS JetStream, PII masking, human-reviewed LLM triage, and a read-only MCP server.
Security analysis of the Model Context Protocol (MCP) ecosystem: an agentic threat taxonomy (prompt injection, tool poisoning), an IEEE-format research paper, and an interactive Slidev presentation.
An on-premise, open-source enterprise reference architecture for data sovereignty: Ubuntu LTS, RKE2/Rancher, rootless Podman, Samba 4 AD + Authentik (SSO/MFA), Wazuh SIEM/XDR, Ansible provisioning, and network-policy, RBAC, and pod-security hardening guides.
An open-source Turkish web book covering 14 security domains and 49 topics, from identity, data, network, endpoint, cloud, OT/ICS, and AI security to SOC operations, mapped to NIST, ISO 27001, MITRE ATT&CK, and Turkish regulations (KVKK, 5651, BDDK).
An open-source Turkish web book in 12 chapters and 39 sections, from enterprise network architecture to deep packet inspection: Wireshark PCAP analysis, DoS/DDoS and C2 tunnel detection, Active Directory/Kerberos security, NetDevOps, cloud networking, and SOC/NOC network forensics.
As autonomous AI agents move into production, protocols like MCP, A2A, and AP2 form the new digital backbone. But what happens when we give models execution privileges? Let's break down the attack surfaces layer by layer.
Balancing Shift-Left and Shift-Right paradigms across the SDLC: Enterprise CI/CD pipeline security, GitOps isolation, and eBPF-powered runtime observability.
A comprehensive guide to Identity and Access Management (IAM) at the core of Zero Trust: exploring SSO, MFA, PAM, RBAC/ABAC models, and modern federation protocols.
Gathering endpoint telemetry with Sysmon (System Monitor), analyzing process execution (Event ID 1), detecting evasion anomalies, and the LetsDefend Threat Hunting walkthrough.
In the world of cybersecurity, threat hunting requires developing proactive approaches to detect attackers and stop their activities. While traditional security measures offer passive methods to stop attackers, deception-based threat hunting takes th...
A hands-on LetsDefend threat hunting writeup analyzing email-borne attack vectors, phishing infrastructure, BEC indicators, and mailbox telemetry triage.
Historical development, architectural differences, and industry alignment of OWASP Top 10 projects covering Web, Mobile, API, K8s, CI/CD, and LLM/Agentic systems.
The Go (Golang) programming language for cybersecurity researchers, building fast network scanners, exploit development, and offensive tool design.
Reclaiming data sovereignty in modern computing paradigms: sovereign technologies like LaTeX, DuckDB, Slidev, Nextcloud Hub, OnlyOffice, Mailcow, and Enterprise Linux.