> ./SECURITY_PROFILE
Cybersecurity is not just an area of interest for me, but a disciplined learning process and an architectural design mindset. I focus on understanding systems in depth, identifying vulnerabilities, and building structures around the Zero Trust principle — sitting at the intersection of system management, traffic analysis, defensive operations, and security automation.
Zero Trust
I design around verification, segmentation, and controlled access instead of implicit trust.
Hybrid Architecture
I balance performance-critical native services with isolated containerized workloads.
Edge Visibility
I care about traffic observability, DNS hygiene, and practical logging over assumptions.
SecOps Automation
I push repetitive security work toward event-driven scanning, analysis, and reporting flows.
Actively Used Systems
These are the environments I actively use for administration, development, simulation, and analysis.
- Linux: Ubuntu (Server and Client Management)
- macOS: Development and Analysis Environment
- Windows: 11 Pro (Corporate Structure Simulations)
System Experience
I have worked across multiple desktop, server, and security-focused operating systems to understand different behaviors and deployment patterns.
- Security-focused systems: Kali Linux, Parrot OS
- Server and desktop systems: CentOS, Fedora, Linux Mint, Windows 10 / 7 / Vista
Technical Infrastructure & Architecture
Hybrid Server Management (Docker & Native)
Instead of confining every service to a single structure, I use a distribution optimized according to the real need of the workload.
- Micro-services: I run database, automation, and media services in isolated Docker containers.
- Web applications: I host performance-critical projects such as cv.egekaya.net and egekaya.net in a native Next.js environment.
Cloudflare Edge Security & Custom Logging
I manually manage DNS records and email security policies instead of relying on default settings.
- DNS and mail security: I manage A, CNAME, MX, TXT, SPF, and DMARC configurations myself.
- Cloudflare Tunnels: I expose internal services securely without taking on the risk of opening ports directly.
- Custom HTTP traffic analysis: I built my own monitoring flow with Cloudflare Workers instead of depending only on ready-made logging tools.
- Edge workflow: Requests are captured at the edge, transmitted to my server by webhook, and archived locally with IP, method, path, and timestamp data.
SecOps & Automation (n8n + AI)
I move security processes away from manual repetition and toward event-driven automations that can run consistently.
- Continuous discovery: Every day, an automated Nmap cycle maps open ports and active services across the environment.
- Automated vulnerability analysis: Nuclei and OWASP ZAP continue the workflow with deeper scans against detected services.
- AI-supported reporting: Findings are read from disk, analyzed by AI agents, and escalated to me as Telegram or email notifications when something matters.
Network Security & Access
My access model is built around controlled connectivity and filtering instead of broad exposure.
- Mesh VPN: I use Tailscale to access servers and services from anywhere as if I were still on the local network.
- DNS filtering: I block ad and tracker traffic across the network with Pi-hole.
Projects
OmniSight
A self-hosted network visibility and SIEM-oriented product, designed around one constraint: metadata only, never content. Architecture, the boundaries I committed to, and what they cost.
- Architecture
- Go · Python · React
- Privacy by design
Silent Ingest Failure
A hardened lab denied 35 hours of agent telemetry while every health signal stayed green. What the monitoring missed mattered more than the bug itself.
- Incident analysis
- Network
- Detection gap
Write-ups and tooling from CTFs and independent research will be published here once they are ready.
ENCRYPTEDAktif Yatırım Bankası A.Ş
Information Technologies Security Intern
July 2, 2025 – August 27, 2025
- > SOC Monitoring & SIEMMonitored daily security events on the Wazuh platform and analyzed logs from firewalls, WAFs, and endpoints to detect anomalies.
- > Threat AnalysisInvestigated alerts to separate false positives from true positives, using threat intelligence tools such as VirusTotal for IP and hash reputation checks.
- > Policy OptimizationHelped refine Wazuh rulesets for File Integrity Monitoring (FIM), Rootcheck, and malware detection to reduce alert fatigue.
- > ReportingResearched and presented technical reports on the OWASP AI Top 10 and emerging threats to the security team.
OmniSight
The self-hosted network visibility product I design and build has its own site, with the documentation, architecture notes, and privacy boundary written out in full.
omnisight.info(opens in a new tab)Initializing security profile...
Compiling principles... [OK]
Loading real-world experience... [4 modules]
Awaiting new write-ups