About Me

I am a co-founder and the CTO of Mulberi, where we are building an AI-native application security platform.

Before starting Mulberi, I was a Postdoctoral Fellow in the Computer Science Department at Dartmouth College. I received my Cybersecurity PhD degree from Khoury College of Computer Sciences at Northeastern University in Boston. I am fortunate to have had Engin Kirda as my PhD advisor.

My research is centered around designing and building offense and defense techniques to improve the security of the Internet. Much of my work has focused on the security challenges of distributed content delivery on the Web — finding classes of attacks (and defenses) that emerge when chains of servers interpret the same HTTP traffic differently. Tools from this line of work have been adopted by the developers of Apache Traffic Server, which powers several major CDNs, and the papers are taught in security curricula at institutions such as CISPA.

I am also interested in biomimetic security research. Before Dartmouth, I was a postdoc in Saket Navlakha's lab at Cold Spring Harbor Laboratory, where I worked with a team of people from computer science and immunology, and studied the immune system and viruses to find solutions to cybersecurity problems. Some of what I learned there is written up on my blog.

Experience

2024 – present: Co-founder & CTO, Mulberi
2023 – 2024: Postdoctoral Fellow, Dartmouth College — formal methods for HTTP security
2023: Postdoctoral Fellow, Cold Spring Harbor Laboratory — computational immunology for cybersecurity
2022: Research Intern, Google — Envoy Platform team
2019: Security Engineer Intern, Facebook — Online Safety team
2017 – 2023: Research Assistant, Northeastern University
2014 – 2017: Penetration Tester, Cyberwise (Istanbul)

Education

2017 – 2023: PhD in Cybersecurity, Northeastern University — dissertation: Systematic Search Techniques for HTTP Server Chain Attack Vectors
2014 – 2016: MSc in Cybersecurity Engineering, Istanbul Sehir University
2008 – 2013: BSc in Computer Engineering, Middle East Technical University

Recognition

2022: Frameshifter nominated for PortSwigger’s Top 10 Web Hacking Techniques of the Year
2022: T-Reqs selected as a finalist, NYU CSAW Applied Research Competition
2021: T-Reqs nominated for PortSwigger’s Top 10 Web Hacking Techniques of the Year
2017: OSCP — Offensive Security Certified Professional

A complete record is in my curriculum vitae.