> berkgoktas.com

BERK GÖKTAŞ

Cybersecurity Engineer / Applied ML Researcher

Boğaziçi University

Portrait of Berk Göktaş
İstanbul, Türkiye
SCROLL

01 — About

I work at the intersection of cybersecurity, detection engineering, and machine learning.

My work spans SOC operations, SIEM engineering, and cloud-native infrastructure, alongside research on reducing analyst alert fatigue through graph-based learning. I care about systems that hold up under production constraints and decisions that can be inspected, not just trusted.

02 — Experience

Where I've worked.

2026 Boğaziçi University

Database Student Assistant · CMPE 321

  • Designed, administered, and graded relational-database projects for 54 student groups.
  • Evaluated backend logic, triggers, stored procedures, and live technical demos.
  • Ran SQL-injection testing to verify input sanitization and parameterized queries.
SQLDatabase SecurityStored Procedures
2025 Doğuş Teknoloji

Cybersecurity & Software Engineering Intern

  • Configured WinCollect and mapped 200+ multi-tenant log sources into IBM QRadar.
  • Built 300+ QRadar reports and detection rules with AQL and Regex, mapped to MITRE ATT&CK.
  • Triaged phishing, DDoS, and malware incidents with Defender EDR/XDR and Cortex XSOAR.
IBM QRadarMITRE ATT&CKDefender XDRCortex XSOAR
2024 Hepsiburada

DevOps Intern

  • Provisioned multi-zone Kubernetes clusters with Terraform, Ansible, and Kubespray.
  • Automated GitLab CI pipelines and enforced change-management with branch-protection webhooks.
  • Integrated HashiCorp Vault for dynamic secrets and diagnosed cluster access incidents.
KubernetesTerraformAnsibleVault

03 — Research

Reducing alert fatigue with graph learning.

A lead research project at Boğaziçi University: a hybrid GNN-LSTM pipeline that turns correlated, multi-SIEM telemetry into a ranked analyst queue — surfacing behavior, not isolated alerts.

Problem

SOC teams face high-volume, repetitive telemetry where low-value alerts bury the urgent sequences.

Method

Heterogeneous graph modeling with GATv2 and GraphSAGE, temporal sequence learning, and explainable scoring.

Result

A ranked queue that prioritizes security-relevant behavior instead of treating alerts as independent events.

04 — Projects

Selected work.

Multi-SIEM Alert Fatigue Research

Hybrid GNN-LSTM workflow for ranking correlated alerts and reducing analyst overload.

PyTorchGNNLSTMXAI

QRadar Detection Engineering

Multi-tenant log onboarding, ATT&CK-aligned detection logic, and SOC reporting.

QRadarAQLRegexSOC

Kubernetes Automation

Multi-zone cluster provisioning with secrets management and change-management safeguards.

KubernetesTerraformVault

Database Systems / SQL Security

Relational design and SQL-injection testing across student database projects.

SQLTriggersSecurity

05 — Skills

Toolkit.

Security

IBM QRadar · SIEM Engineering · AQL · MITRE ATT&CK · Defender EDR/XDR · Cortex XSOAR

DevOps

Kubernetes · Terraform · Ansible · Kubespray · GitLab CI · HashiCorp Vault · Linux · Docker

Machine Learning

Python · PyTorch · GNNs · LSTM · XAI · SHAP · Graph-Based Alert Prioritization

Programming

SQL · Java · Kotlin · Spring Boot · Redis · Apache Airflow · Relational Databases

06 — Contact

Let's talk.