Senior Application Security Engineer

Application security engineer with 10+ years in offensive and application security across banking, telecom, aviation, insurance and e-commerce. Web, API and mobile security testing, threat modeling and CI/CD security. Bugcrowd Top 100 (2018), 150+ validated vulnerabilities, credited for CVE-2026-31974 (OpenProject). OSCP+, eWPTx, eMAPT, CASP.

1. 2018 – Present · Independent Security Researcher (Bug Bounty)
   Self-employed
   Self-employed2018 – Present
   Independent Security Researcher (Bug Bounty)

   Bugcrowd Top 100 (2018). 400+ reports and 150+ validated vulnerabilities on Bugcrowd, Synack Red Team, YesWeHack, Intigriti and Immunefi. Credited for CVE-2026-31974 (OpenProject). Broken Function Level Authorization at Indeed reclassified from Informational to P1 after re-triage ($10,000 bounty).

2. 2025 – 2026 · Senior Application Security / Red Team Engineer (Contract)
   Abu Dhabi Commercial Bank (ADCB)
   Abu Dhabi Commercial Bank (ADCB)2025 – 2026
   Senior Application Security / Red Team Engineer (Contract)

   Led STRIDE threat modeling for a 14-microservice CIAM platform; 52-finding risk register (7 Critical, 16 High) with a remediation roadmap. Reviewed CI/CD pipeline security for a mobile banking backend. Tested the Android banking app against 140 MASVS test cases (25 findings, 6 Critical).

3. 2024 – 2025 · Application Security Senior Consultant
   Kafein Technology Solutions
   Kafein Technology Solutions2024 – 2025
   Application Security Senior Consultant

   Security assessments and secure code reviews for Python, Go, Java and TypeScript products. Set up SAST, SCA, DAST and secrets scanning for 10+ client teams. Triaged bug bounty and VDP reports. Trained 100+ developers on the OWASP API Security Top 10.

4. 2023 – 2024 · Penetration Tester & Application Security Senior Engineer
   Future Technology Systems Co. (FutureTEC), Kuwait
   Future Technology Systems Co. (FutureTEC), Kuwait2023 – 2024
   Penetration Tester & Application Security Senior Engineer

   15+ penetration tests covering web, API, internal infrastructure and network. 200+ findings including SQL injection, authentication and access control issues; 90% fixed within SLA. Advised three banks on zero-trust network redesign.

5. 2022 – 2023 · Penetration Tester & Red Team Senior Specialist
   Barikat Cybersecurity
   Barikat Cybersecurity2022 – 2023
   Penetration Tester & Red Team Senior Specialist

   Web, mobile, API, network and physical security assessments for aviation clients. Worked with IT/OT teams on remediation and retested every finding before go-live.

6. 2021 – 2022 · Information Security Senior Specialist
   Ana Sigorta
   Ana Sigorta2021 – 2022
   Information Security Senior Specialist

   Red team and vulnerability assessments across web, network and cloud. Owned risk analysis, control rollout and the PCI-DSS audit; passed on the first attempt.

7. 2020 – 2021 · Application Security Engineer
   Intertech
   Intertech2020 – 2021
   Application Security Engineer

   Started in pentesting, then led DevSecOps; added security gates to 700+ Jenkins pipelines. Ran an 8-month security academy for 500+ developers; later scans showed 30% fewer OWASP Top 10 issues.

8. 2016 – 2020 · Cybersecurity Consultant (part-time)
   Various companies incl. PwC Turkey
   Various companies incl. PwC Turkey2016 – 2020
   Cybersecurity Consultant (part-time)

   Part-time consulting for energy, aviation, defense and technology clients while studying Computer Engineering. PwC Turkey internship: web, network and mobile testing.

CTF Player (HTB), Shotokan Karate, Analog Photography, Strategy Gaming (EU4, Dota 2).