Emirhan Köse Email & Phone Number

İstanbul, Türkiye

• Serves as a shift supervisor, responsible for creating and distributing work plans, providing L2 level support for escalated alarms, and supporting root cause analysis with the incident response team in case of anomaly detection.• Conducts threat hunting activities by researching whether IOC information from institutions exists within systems.• Monitoring Security Operations Center (SOC) processes and procedures for effective cyber threat monitoring for the company and consulting companies, utilizing SIEM (Security Information and Event Management) products to analyze and correlate security events, detecting potential cyber incidents.• Leveraging EDR (Endpoint Detection and Response) products to enhance threat detection capabilities and investigate endpoint-level security events.• Analyzing malicious activity using tools such as IBM Qradar, Azure, Cisco Stealthwatch, CrowdStrike Falcon, Symantec Endpoint Protection (SEP), Cisco AMP, FireEye EDR, Microsoft Advanced Threat Analytics (ATA), Microsoft Defender, Sentinel, and detecting and addressing false positive security events.• Participating in meetings with incident responders to discuss and address any identified problems, promptly notifying customers of security violations and coordinated necessary actions.• Preparing monthly reports encompassing customer alarms (incidents), log sources/offenses/network components, rule modifications, and detailed offense analyses.• To reduce false positive alarms, tuning efforts were conducted. Regex was employed to enhanceoperational processes.• Staying up to date with the latest cybersecurity trends, emerging threats, and industry regulations through continuous learning and professional development.

• Worked as an L2 Security Analyst in MDR team (Manage Detection and Response), conducted deep analysis and provided timely response to security events escalated from Layer 1 and performed static malware analysis when required.• Maintained direct communication with authorized personnel of client institutions to deliver effective consultancy services.• Utilized various tools, including Palo Alto Networks Cortex XSOAR, VMware Carbon Black EDR, Microsoft Defender Advanced Threat Protection, and CrowdStrike Falcon Insight.• Leveraged MISP to prevent IOC values detected during incident analysis, adhered to SLAs and metrics for handling security incidents and events.• Developed knowledge of adversary tactics and techniques based on security frameworks such as MITRE ATT&CK, SANS, NIST, and the Cyber Kill Chain.• Contributed to the improvement of incident response processes, enhancing incident handling efficiency and minimizing potential impact. • Prepared detailed weekly incident reports, technical briefs, and reports on detected penetration test activities.

• Engaged in active monitoring of security events as a member of a 24/7 Managed Detection and Response Team, assessed the accuracy and determined the priority of alarms generated by various EDR tools.• Leveraged EDR tools and security products such as VMware Carbon Black EDR, Microsoft Defender Advanced Threat Protection, Palo Alto Networks Cortex XDR, and CrowdStrike Falcon Insight to analyze and mitigate cyber threats.• Collaborated effectively with cross-functional teams to promptly investigate and respond to security incidents, issued notifications for false positive events encountered during the monitoring processes.