about

I work on the application security team at Trendyol. Day to day that is DevSecOps and security automation, cloud and Kubernetes security, CI/CD pipeline security, runtime monitoring, and some digital forensics.

A lot of the job is making the secure way the easy way. If doing it properly takes more effort than doing it badly, people do it badly, and writing a policy about it does not change that.

I studied computer science at Bilkent and finished in 2023. Almost everything I know about security I picked up after that, on the job.

Outside work I write small tools, usually because something annoyed me enough. I travel when I can, take photos, and read too much about cars.

what I work with

• Application security and secure SDLC
• Cloud and infrastructure security
• Kubernetes and container security
• CI/CD security and pipeline hardening
• Runtime security monitoring
• Digital forensics
• Go, Python, Java
• Burp Suite, SAST and DAST tooling

certifications

• Kubestronaut · The Linux Foundation

  CKA, CKAD, CKS, KCNA and KCSA, the five CNCF Kubernetes certifications.

• Professional Cloud Security Engineer · Google Cloud
• Web Application Penetration Tester eXtreme (eWPTX) · INE
• Certified in Cybersecurity (CC) · ISC2