yatuk Claim this profile

<!-- ╔══════════════════════════════════════════════════════════════════╗ -->
<!-- ║ FATIH SERDAR ÇAKMAK · PROFILE README ║ -->
<!-- ╚══════════════════════════════════════════════════════════════════╝ -->

<!-- ============================ HEADER ============================ -->

Fatih Serdar Çakmak
SOC Analyst Intern · Blue Team · Detection &amp; Incident Response

<!-- ============================ ABOUT ============================ -->

~/whoami

yaml
name:         Fatih Serdar Çakmak
role:         SOC Analyst Intern  ·  Computer Engineering Student
focus:        [ SOC Operations, Alert Triage, Incident Response, Detection ]
currently:    SOC Intern @ Fibabanka (BDDK-regulated banking SOC)
building:     [ Tamga - LLM security proxy, SOC n8n playbooks, MCPRadar - MCP scanner ]
education:    B.Sc. Computer Engineering @ ITU (expected 2027)
learning:     Detection-as-Code · AI/LLM Security · Threat Hunting
philosophy:   "Most alerts are noise. The interesting part is the few that aren't."
ask_me_about: [ SIEM, MITRE ATTACK, SOAR, Blue Team, LLM Security, Go, Python ]

I'm a Computer Engineering student who spends most of his time inside a SOC. Day to day that means triaging alerts, killing false positives, and tweaking SOAR playbooks so the signal surfaces faster. Mostly I'm learning what incidents actually look like before they reach an analyst, and how much of a working SOC quietly runs on automation.

Off the clock I build security tooling for AI systems: a proxy that sits in front of LLM traffic, a scanner for MCP servers, and n8n playbooks that handle the repetitive half of SOC work. Everything is open source and linked below.

<!-- ============================ EXPERIENCE ============================ -->

~/experience

text
[ Mar 2026 -> Present ]  Fibabanka          ·  Cybersecurity Operations (SOC) Intern
                         └─ SIEM/EDR alert triage · CTI review · incident docs · AI-assisted triage

[ Jul 2025 -> Mar 2026 ]  Doğuş Teknoloji   ·  Cybersecurity and Incident Response Intern
                         └─ SIEM/SOAR/EDR/NDR triage · phishing playbooks · L1 IR · AD and log monitoring

<!-- ============================ STACK ============================ -->

~/tech-stack

🛡️ Security · SOC · Detection

💻 Languages

🧰 Infrastructure and Tooling

📋 Compliance and Frameworks

<!-- ============================ PROJECTS ============================ -->

~/projects

🛡️ Tamga · Self-Hosted LLM Security Proxy

A proxy you host yourself, between your app and the LLM provider (OpenAI, Anthropic, Azure, Vertex). PII like TC Kimlik and IBAN numbers gets redacted before it ever leaves your network; leaked secrets and prompt injection get blocked outright. The static scanner is an Aho-Corasick DFA, so a request costs well under a millisecond to scan. Compliance mappings for KVKK, BDDK, GDPR and PCI-DSS, hash-chained audit logs, a Next.js incident dashboard. Go proxy, Python (FastAPI) analyzer. CI runs a 309-prompt adversarial suite on every change.

⚙️ SOC n8n Workflows · SOC Automation Playbooks for n8n

Ten SOC automation playbooks for n8n: LLM-assisted alert triage, phishing analysis, IOC enrichment, human-approved containment, CVE watch, and reporting. Each workflow is import-ready JSON with no secrets baked in; you wire up credentials on your own instance. The patterns come from things I actually deal with on shift.

🎓 İTÜ MCP · MCP Server for İTÜ Ninova + OBS

An MCP server that plugs İTÜ's Ninova LMS and OBS student portal into Claude, Cursor, or any MCP client. Ask "what's due this week" in Turkish or English and get a real answer: course files, announcements, assignment deadlines, grades, attendance, schedules, transcript downloads. Credentials stay on your machine and only ever go to İTÜ servers, and assignment uploads always require explicit confirmation. Built on FastMCP; install with pipx install itu-mcp.

🎯 SOC Simulation · SIEM / SOAR / EDR Alert Triage Simulation

A simulated shift as a SOC analyst: 127 alerts, 126 false positives, 1 real threat, 6 coffees. It walks through SIEM/SOAR/EDR triage with MITRE ATT&amp;CK mapping. Finding the one real threat is the easy part. Staying sharp through the 126 alerts before it is not. Live at yatuk.github.io/soc-simulation.

📡 MCPRadar · Security Scanner for MCP Servers

Checks Model Context Protocol servers for tool poisoning, prompt injection, and supply-chain rug pulls before your agent runs them. Six detection rules cover zero-width Unicode, injection patterns, encoded blobs, hidden HTML/Markdown, permission scope mismatches, and dangerous tool names. Output is SARIF, so findings land in the GitHub Security tab, and SQLite snapshot diffing catches servers that quietly change their schema after you approved them. Runs with uvx mcpradar scan ..., no install needed. Public leaderboard at yatuk.github.io/mcpradar.

<!-- ============================ STATS ============================ -->

~/github-stats

<!-- ============================ FOOTER ============================ -->

⚡ "Security is a process, not a product." · Bruce Schneier

Collapse