Fatih Serdar Çakmak
> Blue team by day, AI/LLM security tooling by night.
Defending production banking systems @ Fibabanka
Experience
- Triage production SIEM and EDR alerts in a BDDK-regulated banking SOC, escalating confirmed incidents to senior analysts
- Design and run n8n automation workflows for the SOC — LLM-assisted alert triage, IOC enrichment, and phishing analysis to cut manual L1 steps
- Review CTI feeds and track daily alert volumes; write incident documentation used in shift handovers and audit records
- Triaged alerts and filtered false positives across SIEM, SOAR, EDR, and NDR platforms on a live SOC shift
- Wrote and tuned Cortex XSOAR playbooks for phishing and recurring threat patterns together with senior analysts
- Handled L1 incident response tasks and prepared case reports within SLA targets
- Monitored Active Directory and Windows/Linux logs; supported basic network segmentation work
Writeups
All writeups →About
Computer Engineering student at Istanbul Technical University (class of 2027). Started in Industrial Automation at Kocaeli ENKA, which turned out to be solid prep for OT/IT security. At Doğuş Teknoloji I worked across SIEM, SOAR, EDR and NDR platforms: L1 incident response, SOAR playbook writing (phishing playbooks especially), EDR alert tuning, and IT/OT segmentation. Now part-time at Fibabanka doing daily alert triage, CTI review, and n8n SOC automation (LLM-assisted triage, IOC enrichment, phishing analysis) in a BDDK-regulated banking environment. MITRE ATT&CK is how I think about threats. Off the clock I build open-source security tooling for AI systems: Tamga, a self-hosted LLM security proxy, and MCPRadar, a scanner that checks MCP servers for nasty surprises.
Technical Arsenal
Featured projects
Open-source proxy you host yourself, sitting between your app and the LLM provider (OpenAI, Anthropic, Azure, Vertex). Redacts PII inline (TC Kimlik, IBAN, credit cards), blocks leaked secrets, and catches prompt injection with sub-millisecond static scanning via an Aho-Corasick DFA. Ships KVKK / BDDK / GDPR / PCI-DSS compliance mappings, hash-chained audit logs, a Next.js incident dashboard, and a 309-prompt adversarial suite gated in CI.
Catches tool poisoning, prompt injection, and supply-chain rug pulls in Model Context Protocol servers before your agent runs them. 6 detection rules (zero-width Unicode, injection patterns, encoded blobs, hidden HTML/Markdown, permission scope mismatch, dangerous tool names), SARIF output that drops straight into the GitHub Security tab, and SQLite snapshot diffing to flag silent schema changes. One-shot run with uvx, no install needed.
Local MCP server that connects an ITU student's Ninova (LMS) and OBS (student portal) accounts to Claude, Cursor, Codex, and other MCP clients. Ask about assignments, deadlines, grades, transcripts, or attendance in natural language; reads PDF/DOCX files, uploads homework only with explicit confirmation. Local-first: credentials never leave the machine and are sent only to ITU endpoints.
End-to-end SOC simulation: 127 alerts, 126 false positives, 1 real threat. Maps multi-stage attacks to MITRE ATT&CK TTPs, with a React dashboard for real-time alert visualization, realistic log datasets to test SIEM correlation rules, and Python-based SOAR playbook flows for automated triage and enrichment.
Education
Certifications
Get in touch
>_ Force terminal mode
Best on tablet/desktop — the terminal is keyboard-driven.