Fatih Çoşkun

Leading a team of 20+ security professionals across Application Security, Penetration Testing, and Vulnerability Management at Turkish Airlines Technology. Responsible for defining testing strategies, improving AppSec maturity, and ensuring compliance with international security standards (ISO 27001, GDPR, PART IS, PCI DSS, NIST). Driving automation projects and AI-assisted security workflows to strengthen the organization’s cyber resilience. Developing dashboards and metrics for security risk visibility. Integrating security tools (SAST, DAST, SCA, IAST, ASPM) and enhancing threat modeling & DevSecOps pipelines to improve detection and remediation efficiency.

It is Turkey's first volunteer cyber-fighting team. Performs R & D studies in the field of "Cyber Security" and gives cyber security trainings in various institutions and organizations.

The Synack Red Team is a private freelance security research team that spans 6 continents and over 20 countries. Comprised of some of the most sought after security researchers in the world, the Synack Red Team provides web application, mobile application, and host infrastructure penetration testing engagements.

• Realization of project-based penetration tests within the institution and one-to-one tracking of vulnerability closing processes. • Providing technical assistance in order to overcome the weaknesses in the tests by organizing meetings with technical teams. • Supporting PCI applications as a one-to-one security contact from the beginning to the end of project development. • Testing and preparing internal systems for PCI audits. • Management of the received Red Team service, verification of transmitted weaknesses and directing them to the relevant units. • Management of the received Pentest service, assigning and monitoring the tests to the relevant company. • Management of specifications in consultancy service and determination of effort time in the pricing phase. • Managing penetration testing services for consultancy clients, assigning and monitoring tests to the internal team. • Identifying the security products that need to be taken into the institution and making their PoCs. • Improving standard security processes within the organization and establishing relevant procedures.

- Led Technical Team of up to 6 Penetration Testers who traveled all over the Turkey - Executed Penetration Tests against Cloud Providers, Government, Holdings, Telekomication, Health, Energy, Finance sectors. - Manually assessed Web Applications, Mobil Applications, Internal, External and Wireless networks - Tested organizations Social Engineering, Physical and Firewall postures - Completed technical interviews and lab based performance assessments of applicants - Created new attack techniques, training, documentation, scripts and tools for the team - Reviewed customer security documentation to review control intention and execution shortfalls - Gateway for all private sector reports before customer delivery - Generated Collateral records and documents associated with security assessments - Mentored other team members to bridge communication and trade craft to improve deliverable - Findings scored by either OWASP based on customer requirements - Worked to bring new clients in by attending conferences and security expos - Organizer and mentor in CyberCamp organization to bring new cyber security experts to the industry.

- Evaluated the security posture of public and private sector organizations - Executed Internal, External, Web Application, Social Engineering and Firewall assessments - Tested security control application and actual output verses desired output - Validated authentication and authorization dynamics of business and mission systems - Assessed potential vulnerabilities and validated the presence within targets architecture - Documented qualitative risks associated with findings discovered during security posture analysis - Produced targeted Executive Summaries for Organization Senior Leadership personnel - Conducted briefings with business leadership to validate scope(s), objective(s) and desired results - Depicted step-by-step exploitation of an organization for a broad range of audiences - Scored all findings with either OWASP scoring systems - Produced summaries of findings and the affected locations, assets and or hosts - Documented Proofs of Concept that provided examples of exploitation - Developed organizational specific mitigation plans for each finding - Utilized a variety of Penetration Testing and Vulnerability Analysis tools and methodologies - Attributed all findings with industry standard nomenclature and references using: -- OWASP Top 10 Web Application Security Risks, TSE