about
A designer who writes code, a security engineer who designs.
It started with running network cables in 2015; today I report CVEs. The decade in between is below.
Bursa, Türkiye
While studying computing in high school, I joined the IT department at Floteks as an intern in 2015. For two months I fixed user problems, worked with a Fortinet firewall and ran cables in the server room. That summer I understood I liked this work.
In 2019 I started as a web developer at DLL Teknoloji. With PHP and Laravel I built corporate sites, e-commerce systems, a proposal tracking tool, a CRM and an IoT dashboard that read electricity meters remotely. Within a year I learned a great deal — and also saw what I was missing: I had left my degree unfinished.
Between October 2020 and June 2022 I stepped back and completed my Management Information Systems degree. In the same period I earned Cisco CyberOps Associate and CCNA certifications; the Cyber Security Society at university turned a side interest into a serious direction.
I founded my own company in 2022 and brought that work together under the Echomerce brand in 2024. Working alone on client projects forced me to learn design too: logos, brand identity, social media templates, ad creatives. It turned out to be the most useful skill I picked up.
Since November 2025 I have been an Application Security Engineer at Kuark. I write APIs and microservices, then test those same systems against OWASP Top 10 and SANS 25. Wiring SAST and DAST tools into CI/CD, threat modeling, and walking teams through the vulnerabilities I find is my daily work.
In my own time I poke at the software I use. Two flaws I found in a macOS application became CVE records after I reported them to the vendor. The same curiosity produces open-source tools: Erklig scans servers for web shells and backdoor traces, and MergenFlow helps freelancers run their money and their work from one place.
Where that leaves me: when I look at a project I can think about how it will be built, how it will look and where it will break — all at once. For people who would rather talk to one person instead of three, that turns out to be useful.
deneyim
Yaptığım
işler.
Application Security Engineer
Kuark · Full-time · Bursa, Türkiye (Hybrid)
I actively contribute to backend development while also taking responsibility for securing applications, performing vulnerability assessments and evaluating systems from an attacker's perspective. My role goes far beyond a traditional backend developer position: it combines software development with continuous application security improvement.
- Developing APIs, microservices and backend modules with a strong emphasis on secure coding practices
- Conducting security assessments aligned with OWASP Top 10 and SANS 25
- Performing regular Web/API penetration tests and enforcing strict security controls
- Analyzing, prioritizing and reporting vulnerabilities, collaborating with development teams for remediation
- Reducing the attack surface through threat modeling and attack surface analysis
- Integrating SAST, DAST and dependency scanning tools into CI/CD pipelines
- Implementing modern authentication and authorization mechanisms such as OAuth2, JWT, RBAC and MFA
- Using a Red Team mindset to develop proof-of-concept exploits, test bypass techniques and evaluate system resilience
- Supporting log management, security monitoring and incident response activities
Co-Founder & Digital Solutions Consultant
Echomerce · Full-time · Türkiye
In December 2024 I brought my freelance work together under the Echomerce brand. Echomerce focuses on software development, e-commerce solutions, digital marketing and advertising management, building custom solutions around each client's specific needs.
We turn years of business management experience into smart, effective strategies that help clients succeed. Echomerce is not just a brand name; it represents our vision for excellence in digital solutions and a partnership built on trust.
Freelance Web Developer
Yusuf Can TÜRK · Self-employed · Bursa, Türkiye (Remote)
In June 2022 I founded my own company and started taking on freelance work, based on the industry and business management experience I had built up over the years. Running my own business gave me the freedom to serve clients better and to keep developing myself.
Digital Marketing Consultant
Zai Bodrum · Part-time · Bodrum, Muğla (Remote)
For Zai Bodrum I strengthened the brand's digital presence through strategic planning, content management and optimisation of advertising campaigns. My remote support in social media and website management contributed directly to the brand's growth.
Web Developer
CC Holding · Full-time · Bursa, Türkiye (On-site)
Worked full-time as a developer on corporate web projects and internal systems.
Web Software Developer
DLL Teknoloji A.Ş. · Full-time · Türkiye
Worked with PHP, Laravel, HTML5, CSS, JavaScript, jQuery, Vue.js and Bootstrap on both internal and external client solutions: corporate websites, e-commerce sites and custom software, plus internal projects such as a proposal tracking system and a CRM, and IoT projects automating electricity consumption measurement.
Information Technology Intern
Floteks A.Ş. · Intern · Türkiye
Completed my high-school internship in the IT department of Floteks A.Ş., working on user support, firewall management with Fortinet products, server and network administration — gaining hands-on experience with tools used across the industry.
security research
Flaws I
reported.
When I find a flaw in software I use, I tell the vendor. Two of those became CVE records.
Missing WebSocket origin validation (Cross-Site WebSocket Hijacking)
In Textream for macOS prior to 1.5.1, the DirectorServer WebSocket server accepted connections from any origin without validating the HTTP Origin header during the handshake. A…
Resource exhaustion through unlimited connections (DoS)
In Textream for macOS prior to 1.5.1, the DirectorServer WebSocket server imposed no limit on concurrent connections. Combined with a broadcast timer sending state to all…
eğitim & sertifikalar
Kurslar,
sertifikalar.
Öğrenmenin sonu yok. Katıldığım eğitimler ve aldığım sertifikalardan bazıları.
Management Information Systems — BSc
Sivas Cumhuriyet University
Activities and societies: Cumhuriyet University Cyber Security Society.
Web Design and Coding — Associate Degree
Anadolu University
Anadolu University Open Education Faculty.
Computer Programming — Associate Degree
Uludağ University
Activities and societies: Uludağ University Aviation Society (UHAVK).
Advanced Entrepreneurship Training
KOSGEB · Certificate
Traditional Entrepreneurship Training
KOSGEB · Certificate
CyberOps Associate
Cisco · Certificate
Fundamentals of SOC analysis: monitoring, incident response and threat analysis.
CCNA: Introduction to Networks
Cisco · Certificate
NDG Linux Unhatched
Cisco Networking Academy · Certificate
Introduction to Cybersecurity
Cisco · Certificate
English — Pre Intermediate / B1
YDS Academy · Certificate
Building Websites with Laravel
Istanbul Business Institute · Certificate
Credential ID: 0902010290022
konuşmalar & etkinlikler
Seminerler,
etkinlikler.
Topluluklarla bilgi paylaşmak, öğrenmenin en hızlı yolu.
Cumhuriyet University Cyber Security Society — Member
Sivas Cumhuriyet University
Participation in cyber security events and activities.
Uludağ University Aviation Society (UHAVK) — Member
Uludağ University
A project, a collaboration or just a technical question. I usually reply the same day.