Ertugrul Basaranoglu

Managing CDC of Ziraat Finance Group, which is providing 24/7 cyber security services (security monitoring, threat detection and response, platform engineering, security analytics and threat intelligence) to 24 ZFG companies in 18 countries. Defining CDC strategy and creating short, mid and long term roadmap aligning with ZFG business strategy. Reporting directly to C-level related to major incidents and current threat environment Leading forensic investigation and incident response processes, Leading PoC works of new technologies (SIEM, EDR, NDR, SOAR, Sandbox, Deception, Intelligence Platforms etc.) Monitoring threat intelligence sources (comercial&OSINT) especially for the threat actors related to finance sector and for brand-abuse related issues. Evaluating detection contents and incident response playbooks, tuning and improving them with table-top exercises and purple teaming activities. Managing agile cybersecurity projects (sprint planning, daily meetings, retrospective etc.)

Performing and Managing Penetration Tests on Ziraat Finance Group Performing Penetration Tests on Ziraat Finance Group (Russia, Greece, Saudi Arabia...) Auditing Operating System (Windows / *NIX), Microsoft Domain, Network, Database, Firewall, Switch/Router, Web Applications, Virtualization Environment on Ziraat Finance Group Management of BDDK and SPK Penetration Tests Consultancy for Information Security Requests Security Consultancy for IT Projects Performing POC Tests for Requirement of IT Projects Management of Vulnerability Scanning Process Management of Breach and Attack Simulation Process Team Player in SWIFT Processes Team Player in DevSecOps (DevOps Security) Processes Purple Team Player in Threat Detection and Response Processes

Performing and Managing Penetration Tests on Ziraat Finance Group Performing Penetration Tests on Ziraat Finance Group (Saudi Arabia, Turkmenistan, ...) Auditing Operating System (Windows / *NIX), Microsoft Domain, Network, Database, Firewall, Switch/Router, Web Applications, Virtualization Environment on Ziraat Finance Group Management of BDDK and SPK Penetration Tests Consultancy for Information Security Requests Security Consultancy for IT Projects Performing POC Tests for Requirement of IT Projects Management of Vulnerability Scanning Process Management of Breach and Attack Simulation Process Team Player in SWIFT Processes Team Player in DevSecOps (DevOps Security) Processes Purple Team Player in Threat Detection and Response Processes

Performing Penetration Tests on Ziraat Finance Group (Bulgaria, Sarajevo, Azerbaijan, Saudi Arabia, Kazakhistan, Uzbekistan, ...) Auditing Operating System (Windows / *NIX), Microsoft Domain, Network, Database, Firewall, Switch/Router, Web Applications, Virtualization Environment on Ziraat Finance Group (Ziraatbank, Ziraat Yatırım, Ziraat Sigorta ve Emeklilik, ...) Management of BDDK and SPK Penetration Tests Consultancy for Information Security Requests Security Consultancy for IT Projects Performing POC Tests for Requirement of IT Projects Management of Vulnerability Scanning Process Management of Breach and Attack Simulation Process Management of Anti-Phishing Solution and Cybersecurity Awareness Platform Team Player in SWIFT Processes Purple Team Player in Threat Detection and Response Processes

Information Security Assurance Consultancy for Information Security Requests Singularizing and Ameliorating Request Processes Team Player in PCI-DSS Processes Team Member in Information Security Awareness Program Management of External && Web Penetration Tests Performing Social Enginering Attacks Network Penetration Tests Wireless Network Audits Information System Audits Team Player in ISO 27001:2013 Certification Processes Generating Policies and Procedures Information System Audits Call Center Audits Policy Management on Data Leakage Prevention System - DLP Policy Management on Security Information and Event Management - SIEM

Red Team (Attacker) Member in Locked Shields (Cyber Defence Exercise) organized by NATO CCDCOE Security Audits in NATO Projects such as AirC2IS and AMN INT-CORE Team Member in National Security Organizations such as Cyber Security Drill of Turkey (Ulusal Siber Güvenlik Tatbikatı) organized by TSK Team Member in Cyber Security Summer Camp (Siber Güvenlik Yaz Kampı) organized by TÜBİTAK Team Member in Cyber Defense Competition Between Universities (Üniversiteler Arası Siber Meydan Yarışması) organized by TÜBİTAK Teaching various IT security trainings (Windows Operating System Security and Microsoft Systems Security) in the scope of Public Organizations Information Security Project organized by TÜBİTAK Teaching various penetration testing methods in the scope of White Hat Hacker Certification Program organized by TSE Windows and Microsoft Domain Environment Penetration Tests Internal Network Penetration Tests External Network Penetration Tests MSSQL & Oracle Penetration Tests Social Engineering Penetration Tests Auditing Windows Operating Systems and Microsoft Technologies such as Active Directory & Group Policy, DNS, IIS Auditing MSSQL and Oracle Database Systems Auditing Virtualization Systems Physical Control Reviews Network Architecture Reviews Maintaning Domain System of Internal Network

Management of Identity Management Systems - IDM Management and Centralization of UNIX / LINUX Systems Management of Web Proxy & URL Filtering System Management of Data Leakage Prevention System - DLP Management of Intrusion Prevention System - IPS Management of Anomally Detection System - ADS Management of Issue Management Process System Management of Web Application Vulnerability Scanner System Management of Code Analysing System IT Audit Management & Compliance Team Player in ISO 27001:2005 & ISO 9001:2008 Certification Processes Preparing IT Risk Analysis Reports (Legal Compliance, Active Directory, Database, Separation of Duties, UNIX, SVN...) Vulnerability Scanner and Assessment Firewall, PKI Process, Log Management System

Software intern in TUBITAK - UEKAE(Ulusal Elektronik ve Kriptoloji Arastirma Enstitusu).

Hardware intern in Renault TURKIYE - Information Technology Department

Job Definition: Construction of computer and technology laboratory for 12 schools (System and Network Construction - Project based job)

Graduation Thesis: Microsoft Domain Environment Penetration Testing Methodology (MSDEPTM) and Mitigations Against These Attacks

Education Language: English

Education Language: French Graduation Thesis: Programming Microprocessor (8085)