Triaging alerts, chasing true positives · Building open-source AI security tooling · Computer Engineering @ ITU, Class of 2027
name: Fatih Serdar Çakmak
role: SOC Analyst Intern · Computer Engineering Student
focus: [ SOC Operations, Alert Triage, Incident Response, Detection ]
currently: SOC Intern @ Fibabanka (BDDK-regulated banking SOC)
building: [ Tamga - LLM security proxy, SOC n8n playbooks, MCPRadar - MCP scanner ]
education: B.Sc. Computer Engineering @ ITU (expected 2027)I'm a Computer Engineering student who spends most of his time inside a SOC. Day to day that means triaging alerts, killing false positives, and tweaking SOAR playbooks so the signal surfaces faster. Mostly I'm learning what incidents actually look like before they reach an analyst, and how much of a working SOC quietly runs on automation.
Off the clock I build security tooling for AI systems: a proxy that sits in front of LLM traffic, a scanner for MCP servers, and n8n playbooks that handle the repetitive half of SOC work. Everything is open source and linked below.
[ Mar 2026 -> Present ] Fibabanka · Cybersecurity Operations (SOC) Intern
└─ SIEM/EDR alert triage · CTI review · incident docs · AI-assisted triage
[ Jul 2025 -> Mar 2026 ] Doğuş Teknoloji · Cybersecurity and Incident Response Intern
└─ SIEM/SOAR/EDR/NDR triage · phishing playbooks · L1 IR · AD and log monitoring
| Project | What it does | Stack |
|---|---|---|
 🛡️ Tamga |
Self-hosted proxy that redacts PII, blocks leaked secrets, and catches prompt injection before it hits your LLM provider. Sub-millisecond scanning, KVKK/BDDK/GDPR/PCI-DSS mappings. | Go Python Next.js |
 ⚙️ SOC n8n Workflows |
Ten import-ready n8n playbooks for alert triage, phishing analysis, IOC enrichment, and CVE watch. No secrets baked in. | n8n JSON |
 🎓 İTÜ MCP |
MCP server that connects İTÜ's Ninova and OBS to Claude, Cursor, and other AI clients. Course files, grades, deadlines, transcript, all queryable in plain language. | Python FastMCP |
 🗂️ İTÜ Archive |
OBS only keeps the current term online, so this pulls the course schedule and academic calendar daily and keeps it. 27 terms, 64k+ section records since 2016. | Go JSON/CSV |
 🎯 SOC Simulation |
A simulated SOC shift: 127 alerts, 126 false positives, 1 real threat, 6 coffees. SIEM/SOAR/EDR triage with MITRE ATT&CK mapping. Live demo. | Python |
 📡 MCPRadar |
Scans MCP servers for tool poisoning, prompt injection, and supply-chain rug pulls before your agent runs them. SARIF output, public leaderboard. | Python |
