Emin Fidan

Key Responsibilities & Achievements: Security Architecture & Consultancy - Established the organization's Security Architecture Review standards and guides, conducting proactive reviews with engineering teams during the design phase to ensure "Security by Design." - Acted as a security consultant for internal process designs, ensuring compliant and secure data flows across services. AppSec & DevSecOps - Conducted whitebox security testing - Implemented Software Supply Chain Security protocols to detect and remediate vulns. - Developed and implemented a custom Security Step for CI/CD pipelines from scratch. - Guided the production of Secure Base Images and oversaw Image Signing processes to enhance container security. - Implemented Secure Code Warrior platform to gamify security training for the developer community. Vulnerability Management & Offensive Security - Managed the end-to-end Bug Bounty Program, including policy definition, CVSS scoring, verification, and remediation coordination. - Orchestrated Outsource Penetration Testing cycles, managing scoping, procurement, and retest processes. - Conducted manual security assessments for services prior to production releases. Network & Cloud Security - Managed & Revise WAF rules - Managed & Revise Security Groups IAM - Hardened infrastructure via managed granular IAM policies on VPNs based on the principle of least privilege. - Analyse & Revise Application RBAC Controls and Rules Incident Response & CTI - Contribute Incident Response Playbooks for phishing and malware analysis; managed real-time response, forensics, and post-incident reviews. - Contribute Cyber Threat Intelligence (CTI) efforts, monitoring for leaked credentials/domains and managing takedown processes (USOM/Registrars). - Contribute Fine-tunning SIEM & EDR alerts to improve detection accuracy

- Performed manual source code reviews, security audits, and targeted security research for assessed products - Developed internal tools and solutions to improve application security processes - Acted as a security subject matter expert for secure coding, security testing, mobile, cloud, container, and application security - Configured and analyzed SAST, DAST and IAST scans - Conducted manual application security testing - Supported the Bug Bounty Program, including validation and triage - Assisted teams with reproducing, triaging, and remediating application security vulnerabilities - Contributed to security processes and automation to prevent recurring vulnerability classes - Enforced application security standards and guidelines across the Secure SDLC - Helped development teams understand and prioritize security findings from scanning tools - Collaborated with development and infrastructure teams to secure cloud-native applications (containers, microservices, serverless) - Worked with teams to identify and remediate cloud environment vulnerabilities - Collaborate adding mobile application security controls into CI/CD pipelines - Delivered web, mobile, and secure code review training during security hackathons

- Web Application Penetration Testing - Mobile Application Penetration Testing - API Pentesting - Static Code Analysis - Dynamic Code Analysis - Vulnerability Management / Assesment - Penetration Test Reporting Process

- Web Application Penetration Testing - API Pentesting - Application Security Research - Secure Code Review - Vulnerability Management / Assesment - Penetration Test Reporting Process

- Vulnerability Reporting Process - Security Research - Web Pentesting Studies • Information Security • Vulnerability Managment

- Vulnerability Reporting Process - Security Research

Offensive & AppSec studies, lab solutions and writes-up on cyber security. https://medium.com/@eminf.egitim

- Simulate Web Security Attacks on Vulnerable Machine - Bash Scripting - Observation SOC Team Process and Case Studies on IBM QRadar • Make Presentation on Phishing

2020 Teknofest Unmanned Underwater Vehicle Competition Finalist Team Image Processing and Software Team Leader - Image Processing - Software Development - Reporting Process - Rasberry Pi

Ege University Technology Community member and Board Treasurer - Technical Project Planning - Training Coordination - Sponsorship Negotiations - Social Media Management