Looking for a job

Emre Koybasi

@emrekoybasi

Message

Cyber Threat Intelligence Director at Behind24, leading OSINT and dark web intelligence operations.

Turkey

Message

At Behind24, I lead strategic Cyber Threat Intelligence operations and intelligence initiatives. I conduct OSINT and dark web intelligence, profile threat actors, and analyze APT groups and adversary TTPs.

At Kalyon Holding - OnBT, I led adversary emulation and attack simulation engagements to evaluate security controls. I also conducted penetration testing and assessed EDR/XDR evasion capabilities.

At Istanbul Grand Airport, I performed proactive threat hunting using Splunk and managed end-to-end CTI. I researched APT groups and developed detection rules and use cases.

At BRANDEFENSE, I led APT tracking, OSINT investigations, and dark web monitoring. I also developed DraculaOS, a Linux-based OS for OSINT and cyber intelligence with integrated security and privacy tools.

Experience

Work history, roles, and key accomplishments

Current

Director of Cyber Threat Intelligence

Current

Behind24

Jun 2026 - Present (4 months)

Leading strategic Cyber Threat Intelligence operations and intelligence initiatives. Conducting advanced OSINT, dark web intelligence, and threat actor profiling.

Threat Intelligence OSINT Dark Web Intelligence Threat Profiling APT Analysis Adversarial TTPs Intelligence Reporting

Offensive Security Expert

Kalyon Holding - OnBT

Feb 2026 - Sep 2026 (7 months)

Led Adversary Emulation and Attack Simulation engagements to emulate threat actor TTPs and evaluate security controls. Conducted black-box penetration testing and security assessments across web applications, Active Directory, enterprise systems, and critical infrastructure.

Adversary Emulation Attack Simulation Penetration Testing Web Application Security Active Directory EDR Evasion SOC Operations Threat Hunting Detection Engineering IBM QRadar

Senior Cyber Security Expert

Istanbul Grand Airport

May 2025 - Feb 2026 (9 months)

Performed proactive threat hunting (SOC L3) using Splunk, correlating CTI with internal telemetry. Managed end-to-end CTI, delivering actionable intelligence and researching APT groups, malware, and TTPs aligned with MITRE ATT&CK.

Threat Hunting SOC L3 Analyst Splunk Threat Intelligence APT Research MITRE ATT&CK Detection Engineering

Threat Researcher

BRANDEFENSE

Jan 2024 - Mar 2025 (1 year 2 months)

Led APT tracking, OSINT investigations, and dark web monitoring for enterprise and government clients. Investigated threat actors, C2 infrastructure, and cyber espionage campaigns.

APT Tracking OSINT Dark Web Monitoring Malware Analysis Exploit Assessment Forensic Investigations Threat Profiling

SOC Specialist

Platin Bilisim

Nov 2021 - Jan 2024 (2 years 2 months)

Led incident response, improving detection, triage, and containment processes. Developed and tuned QRadar rules, enhancing detection and reducing false positives.

Incident Response SIEM IBM QRadar Detection Engineering SOC Operations

Offensive Security Specialist

Shape Security

Nov 2020 - Nov 2021 (1 year)

Led full-scope red team engagements, including pentesting, lateral movement, and privilege escalation. Performed advanced vulnerability exploitation using Nessus, Rapid7, and manual techniques.

Red Team Penetration Testing Lateral Movement OS Privilege Escalation Nessus Rapid7 Wireless Penetration OSINT