Talha Karakumru

- Performing manual source code reviews and audits and/or any needed security research on the product suites undergoing assessment - Developing products and tools to improve application security processes - Being a subject matter expert and ambassador to Trendyol Engineering for secure coding practices, security testing, mobile platform security, cloud security, container security and all aspects of application and product security - Creating, configuring, and running scans using the DAST/IAST tools - Manual security testing - Supporting the bug bounty program - Assisting teams in reproducing, triaging, and addressing application security vulnerabilities - Assisting in development of security processes and automated tooling that prevent classes of security issues - Enforcement of security standards and guidelines with respect to application security and secure SDLC - Helping application development teams understand findings from various security scanning tools, both in terms of what the vulnerability is and why it’s important to fix - Collaborating with application development and infrastructure teams to protect web applications in an advanced cloud environment (Containers, Serverless Architectures, Microservices) - Working with other teams to identify and resolve vulnerabilities in the cloud environment - Partnering with engineering teams and guiding the integration of security controls into CI/CD pipelines such as SAST, DAST, SCA, IaC, secret detection

- Web application and API security tests - Mobile application security tests - Source code review and audit - Internal, external and wireless network security tests - VOIP security tests - Social engineering and DDOS tests - ISO27001 security tests - BDDK security tests

- Breach and attack simulations - Application security research - Attack surface analysis - Threat modeling

- Web application and API security tests - Mobile application security tests - Source code review and audit - Internal, external and wireless network security tests - VOIP security tests - Social engineering and DDOS tests - Attack surface analysis - Threat modeling - ISO27001 security tests - BDDK security tests

- Web application and API security tests - Mobile application security tests - Source code review and audit - Internal, external and wireless network security tests - Social engineering, DDOS and load tests - ISO27001 security tests

- I published around 40 blog posts about cyber security, computer science and software engineering