Furkan YUKSEL

•Designing, implementing, and optimizing scalable SIEM architectures for distributed environments Developing and executing customized architecture plans for both local and global multi-country infrastructures.Log source integration, parser development, semantic context design, visibility, and compliance management.Capacity planning, log flow optimization, backup, migration, and performance enhancement strategies •Scenario-based rule creation, correlation development, and cross-correlation design.Developing advanced detection scenarios through static and dynamic rule mechanisms.Reducing false positives, optimizing rules, and conducting performance reviews.Applying detection engineering methodologies to ensure end-to-end visibility of advanced attack chains •Detecting security breaches, conducting incident analysis, and classifying attack types.Executing rapid post-attack action plans, reporting, and implementing remediation measures.Proactive threat hunting, supporting attack simulations, and developing new detection rules based on results.Automating incident response and increasing operational efficiency through SOAR integration •Effective utilization and integration of modern technologies (XDR,EDR,NDR,SOAR,CTI,Deception) into the central SIEM solution.Continuous improvement planning for integrated technologies to enhance the maturity of enterprise security architecture.Designing and maintaining security architecture in compliance with regulations and industry standards •Periodic execution of attack simulations across different organizational assets through BAS solutions. Updating detection scores and rule sets based on BAS simulation results. Developing new detection rules from BAS-generated logs and integrating them into the SIEM infrastructure. Expanding detection coverage on critical assets by leveraging BAS outcomes to improve overall attack visibility. Transforming SIEM into an EDR-like platform through specific concepts and tailored implementations.

•End-to-end management of all actions on the SIEM platform. System health checks and compliance with regulations. System integration of utilized and newly deployed cybersecurity product. Development of parser mechanisms. Troubuleshooting. Providing support for issue resolution to other subsidiaries within the company. Inventory management. Log source tracking. Migration processes. Backup strategies. Rule adjustments. Log visibility. Application usage and effectiveness.Designing SIEM architecture for environments in different countries of the organization. Planning and implementation based on specific needs. •SOC actions: Scenario-based rule creation, fine tuning, rule performance reviews, providing technical infrastructure and log control for rules, creating cross-correlation according to criticality, importance and significance level, static and dynamic rule actions, developments specific to attack detection and response.Preparing the technical groundwork for rules end-to-end (field detect, parsing, semantic context design) •Incident Management. Detection of security breaches and identification/analysis of attack types. Taking action after attack analysis. Reporting and improvement actions before and after the attack process. •Integrated Blue Team Actions

•Work continued within the scope of organizational integrity and continuity. •Took an active role in debugging cases. •Integrity was achieved by integrating different and current log sources into SIEM. DSM modifications were provided.

I took on the entire SIEM responsibility of the company I was assigned to, which was large and complex in structure. During my consultancy period, I took action on the solution of multiple problems and the implementation of requests. List of Actions & Topics I took: •All operating operations included within the SIEM organization (from small to large) •Cyber Security Management •Architecture & Arch. remediation (continuous development) •Installing & Managing SIEM end to end implementation, and integration in the customer/production environment •QRadar Implementation, Administration, and Configuration of Cyber Security Rules (for offenses), and consultation on security policy remediations •Configuring and troubleshooting administrative requirements (e.g. backup/restore strategy, retention policies, routing rules, etc.) •Arranging & managing meetings with IBM Global (solutions) with the customers •Owning the inventory management of the institution I work for and constantly organizing and keeping the Server side up to date. •Acting as a contact for the security operations center (SOC) and incident response team •Writing DSM and event mapping process from scratch for Resources that do not exist by default. •App installation, QRadar & wincollect updates (System component actions) •Systematic Critical situation detection and 24/7 service control and situation action

During the 9-week internship, I was asked to research and present on each subject for 1 week. It was requested to make explanations at a level that any human being could understand. During the internship, detailed presentation of cyber security solutions and product supported (technological infrastructure) presentation were requested. The topics I made presentations on: -SIEM -SOAR -PAM -EDR -DLP -XDR -UTM FW -Vulnerability -MITRE att&ck framework *Some of the presentations I have made are available on my blog: furkanyuksel.net