about
The short version
I started in a research lab, not a SOC. My PhD at EURECOM was spent standing up honeypots on the open web and reading what came back: thousands of attackers poking at deliberately weak applications, then doing whatever they actually do once they are inside. That habit of studying behaviour first and writing rules second has followed me into every job since.
From there I went industrial. At Amadeus I built the automation layer for three SOC teams, including an in-house SOAR and the pipelines feeding three different SIEMs. At Glovo I hired and led a cyber defense team of four, and learned what incident command feels like when the company is still trading through the incident. At Dataiku I was the first dedicated security engineer, which meant writing the procedures, choosing the tooling and answering the auditors, all in the same quarter.
Today I am at Aramis Group, building a group-wide threat monitoring and response platform on open source foundations for subsidiaries across several countries. Detection as code, automation wherever a human is doing something twice, and standards that the engineering teams can actually live with.
leadership
Where I carried the responsibility
- Incident commander on high-severity incidents Ran response on major incidents at Glovo and Aramis Group, out of more than twenty handled by the team, and wrote the crisis management runbooks still in use.
- Founded a security function as the first dedicated hire At Dataiku, stood up procedures, tooling benchmarks and audit workstreams for SOC 2 Type 2 and ISO 27001 with nobody to inherit them from.
- Built and led a cyber defense team Hired and ran four engineers at Glovo across threat detection and incident response, with on-call guidelines and playbooks written from scratch.
- Set group-wide security standards across subsidiaries Defined corporate and infrastructure security practice for Aramis Group's operating companies in multiple countries, backed by the monitoring platform that evidences it.
- Architected SIEM and custom SOAR for enterprise SOCs Designed ingestion across three SIEM platforms and built an in-house SOAR with a Python playbook library serving three SOC teams at Amadeus.
experience
Track record
2023.11present Aramis Group current Lead Threat Hunter · Paris, France Building the group's threat monitoring and response capability from the ground up, for subsidiaries in several countries.
- Built the platform on open source foundations: Elasticsearch, Kibana, ElastAlert, then ELK SIEM rules as the detection catalogue grew.
- Integrated telemetry from Microsoft Entra ID, Defender, SentinelOne, Google Workspace, GCP, AWS CloudWatch and Keycloak into one surface.
- Introduced Detection as Code for rule management, and maintain Shuffle SOAR so routine triage stops reaching a human.
- Write incident response playbooks, run tabletop exercises, and take incident command when something real lands.
- Set security standards for corporate and infrastructure IT, and move DevSecOps practice into the engineering workflow.
2023.012023.08 Dataiku Head of Cyber Security · Paris, France First dedicated security engineer, building the function and its operating model.
- Wrote the security procedures, guidelines and internal policy set, and acted as the point of contact for engineering and business teams.
- Contributed to SOC 2 Type 2 and ISO 27001 audit workstreams.
- Benchmarked the toolkit across EDR, SIEM, email gateway and password management, and assessed DLP capability on a dedicated test bed.
- Reviewed and hardened joiner and leaver processes with IT and People teams.
2021.082022.12 Glovo Head of Cyber Defense · Barcelona, Spain Built and led the cyber defense team covering threat detection and incident response.
- Hired and ran a team of four across two streams, detection and response.
- Acted as incident commander on several high-severity incidents, out of more than twenty handled overall.
- Wrote on-call guidelines, crisis management runbooks and response playbooks, and contributed to incident response policy and risk assessment.
- Started the in-house SOAR platform project and deepened the team's AWS and cloud risk coverage.
2018.062021.08 Amadeus IT Group Information Security Architect · Sophia-Antipolis, France Application SOC and later the global SOC, owning the integration and automation layer behind security and fraud investigations.
- Built an in-house SOAR in Python with integration libraries and a large playbook catalogue, plus ingestion and export pipelines across Splunk, QRadar and Logz.io and two ticketing systems.
- Administered TheHive for three SOC teams and wrote the response tooling analysts used daily.
- Led a honeypot-style project to identify unwanted scraping bots and cut their cost impact on backend systems.
- Led synthetic monitoring of customer-facing frontends to surface security gaps and compromised third parties.
- Handled very high severity incidents involving customer applications and data exposure, and ran vendor PoCs across threat intelligence, WAF, RASP, SIEM, SOAR and bot mitigation.
2014.022017.12 EURECOM Security Researcher, PhD · Sophia-Antipolis, France Studied attacker behaviour on the web, with honeypots as the instrument.
- Designed, deployed and operated web honeypots to collect attack data at scale.
- Developed methods to extract indicators of compromise automatically from web application attacks, published at WWW, RAID and SAC.
- Analysed post-exploitation activity and the abuse of server-side request functionality.
2013.092014.01 LOGO Siber Güvenlik Software Developer · Istanbul, Turkey Developed modules for a next-generation firewall product.
- Built components for the Unified Threat Management platform, covering licensing, DHCP and Java RMI communication.
2011.032013.07 Sabancı University Research and Teaching Assistant · Istanbul, Turkey Wireless sensor network security research, alongside teaching in computer security.
- Researched wireless sensor network security and designed a cryptographic key pre-distribution scheme for multi-phase deployments.
- Taught alongside faculty on software engineering, computer networks, and computer and network security.
skills
Toolkit
Detection & response
- Threat hunting
- Detection engineering
- Incident command
- Detection as Code · Sigma
- Post-exploitation analysis
Platforms
- Elastic Stack · ELK SIEM
- Shuffle SOAR · TheHive
- Splunk · QRadar
- SentinelOne · Defender
- Burp Suite
Cloud & identity
- AWS
- GCP · Azure
- Entra ID · Okta · Keycloak
- Google Workspace
- Linux hardening
Automation
- Python
- Bash
- Terraform
- Log pipelines
- API integrations
LanguagesTurkish (native) · English (fluent) · French (working)
research & education
Published and studied
Peer-reviewed papers
Automatic Extraction of Indicators of Compromise for Web Applications
WWW 2016 · International World Wide Web Conference
Attacks Landscape in the Dark Side of the Web
SAC 2017 · ACM Symposium on Applied ComputingBest paper, security track
Uses and Abuses of Server-Side Requests
RAID 2016 · Research in Attacks, Intrusions and Defenses
Uneven Key Pre-Distribution Scheme for Multi-Phase Wireless Sensor Networks
ISCIS 2013 · Springer
Education
PhD, Computer and Information Systems Security
EURECOM · 2014 - 2017
Web security and attacker behaviour: honeypot design, large-scale attack data collection, automated IOC extraction.
MSc, Computer Science and Engineering
Sabancı University · 2011 - 2013
Wireless sensor network security. TÜBİTAK research project scholarship.
BSc, Computer Science and Engineering
Sabancı University · 2006 - 2011
Achievement scholarship, top 0.17% in the national entrance examination.
contact
Say hello
No plain-text address on this page. If you work in security you already know why, and if you write scrapers for a living, consider this a small toll.
Away from the keyboard it is mostly cooking, books and a guitar. I played CTFs for years, and these days I would rather pull apart a real payload out of a honeypot than grind a contrived one.
$ python3 -c "print('mronur' + '89' + chr(64) + 'gmail' + chr(46) + 'com')"