Mustafa Bi̇rcan Email & Phone Number

Denizli, Denizli, Tr

İstanbul, Türkiye

Technical Skills and Work Experience- Advanced Incident Response - Handling complex security incidents and performing advanced analysis. Experienced in triage, investigation, and response strategies.- Threat Intelligence - Proficient in gathering, analyzing, and sharing threat intelligence. Knowledge of threat actors, tactics, techniques, and procedures (TTPs).- SIEM (QRadar) - Extensive knowledge of QRadar for monitoring and analyzing security events. Creating custom rules, alerts, and reports.- Digital Forensics - Experienced with tools like EnCase and FTK for forensic analysis.- Network Security - Understanding of network protocols, firewalls, IDS/IPS systems, and other security technologies. Detecting anomalies in network traffic.- Vulnerability Management - Proficient in identifying, assessing, and mitigating vulnerabilities. Experienced with Nessus and Nmap.- Penetration Testing - Skilled in conducting penetration tests and vulnerability assessments. Proficient with Metasploit and Burp Suite.Work ExperienceAs a Cyber Defense Specialist, I develop and optimize rules in IBM QRadar, use regex for property creation, and provide solutions aligned with customer requests. I offer cyber defense consultancy, write CTI rules, and analyze alarms. I conduct detailed analysis on QRadar, implement rule tightening based on feedback, and develop rules within the MITRE ATT&CK framework. I also map QRadar rules to MITRE ATT&CK to enhance security posture.- Developing and optimizing QRadar rules.- Creating regex-based properties.- Providing customer-specific solutions.- Offering cyber defense consultancy.- Writing and analyzing CTI rules and alarms.- Conducting detailed analysis in QRadar.- Implementing rule adjustments based on feedback.- Developing rules within MITRE ATT&CK.- Mapping QRadar rules to MITRE ATT&CK.My expertise strengthens the organization's security and ensures robust defense against evolving threats.

Ankara, Türkiye

Started working as an L2 Security Analyst in the Ministry of Treasury and Finance as an outsourced personnel within Adeo.- Tier 2 Security Analyst (Incident Responder): - Conducting threat hunting and incident response to emerging threats using Carbon Black EDR. - Tightening existing rules on Carbon Black and creating new rules. - Developing rules on VMware Carbon Black EDR (On Prem) within the framework of MITRE ATT&CK. - Generating reports on incidents that occur. - Conducting detailed investigations of threats identified by Level 1 analysts. - Working on detecting and preventing persistent threats. - Reviewing alarms using XSOAR. - Advanced threat hunting utilizing Endpoint Detection and Response (Carbon Black EDR), Security Orchestration Automation and Response (XSOAR), and Network Detection and Response (Vectra NDR) products. - Performing Advanced Persistent Threat (APT) analysis using Thor and Loki tools. - Digital Forensic Incident Response (DFIR): Conducting forensic analysis in areas such as Amcache, Shimcache, Lnk, Prefetch, USB Drive Forensics, Volume Shadow Copy Services, Jump List, and Powershell Forensics.

Cybersecurity Operations Center Threat Monitoring L1 Team Lead- 24/7 Threat Monitoring and Security Incident Detection: Performed 24/7 threat monitoring, security incident detection, and alarm tracking using tools such as Logsign SIEM and Logsign SOAR.- Threat Profile Creation: Developed threat profiles for SOC clients and established necessary monitoring mechanisms.- Security Breach Management: Coordinated with clients to resolve major security breaches and implemented preventive measures to avoid recurrence.- False Positive Management: Identified false positive security events and determined necessary actions to mitigate them.- Rule Tuning and Optimization: Collaborated with Level 2 Analysts to adjust rules written in Logsign SIEM, enhancing event capture processes.- Initial Notification and Coordination: Provided initial notification of security breaches in client systems and ensured proper coordination for emergency responses.- System Health Maintenance: Conducted audits and interventions as per established procedures to maintain system health.- Monthly Reporting and Analysis: Prepared detailed monthly reports analyzing customer alarms (events), log sources, threat/network components, rule changes, and violations.- Review of L1 Analyst Alarms: Conducted detailed analysis of security alarms escalated by L1 analysts.- Shift Management and L1 Team Leadership: Acted as a shift supervisor, preparing work plans and assigning tasks to L1 analysts, while also leading the L1 team and ensuring effective coordination.- Training: Provided training to newly joined L1 analysts, supporting their development and integration into the team.

Ataşehir, İstanbul, Türkiye

Cybersecurity Operations Center (SOC) Threat Monitoring Unit Cybersecurity Analyst- Threat Monitoring and Incident Detection: Conducted 24/7 threat monitoring, security incident detection, and alarm tracking using security information and event management tools such as Logsign SIEM and Logsign SOAR.- Threat Profile Development: Developed threat profiles for SOC clients and established necessary monitoring mechanisms to ensure comprehensive coverage.- Security Breach Management: Coordinated with clients to address major security breaches, working closely to prevent recurrence and manage crisis situations effectively.- False Positive Management: Identified false positive security incidents, determined necessary improvement actions, and implemented measures to reduce their occurrence.- Incident Notification and Coordination: Provided initial notification of security breaches in client systems, ensuring proper coordination and activation of emergency response plans.- Reporting and Analysis: Conducted detailed analyses of client alarms, log sources, threat/network components, rule changes, and breaches, and prepared comprehensive monthly reports.

Master'S Degree, Cyber Security, 3.25

- Personal and Corporate Information Security - Computer Incident Analysis and Response Techniques - Critical Infrastructures and Security.

Lisans Derecesi, İktisat, 2.55

Uygulamalı Sızma Testi

- Linux Penetration Test - Windows Penetration Test - Web Penetration Test

98/100

- Fundamentals Of Computer Networking - Introduction To Virtualization - Installing And Configuring Windows 10 - Installation, Storage.

Cyber Security Specialist, 100

Penetration Tester