Orhan Yildirim

• Led global penetration testing program, reporting directly to head of global security.
• Drove globalization of penetration testing operations for consistent security assessment across regions.
• Aligned penetration testing engagements with GRC frameworks for compliance-driven risk assessments.
• Designed and delivered training programs to upskill penetration testing team on new attack techniques.
• Continuously improved penetration testing processes, tools, and reporting standards to enhance operational maturity.

Conducted penetration testing for web, mobile, and REST APIs within DAST team.

• Executed manual pentests focused on compliance-driven assessments and business logic abuse.
• Integrated AI-driven automation into application security workflows to enhance efficiency.
• Ensured adherence to web and mobile security standards (OWASP WSTG, MASVS/MSTG).
• Performed API security assessments using Swagger/OpenAPI and Postman, including auth abuse and fuzzing.
• Managed compliance testing for ASV, FedRAMP, and SOX requirements.
• Developed security documentation and methodologies for consistent implementation.

Conducted offensive security testing across APIs, mobile applications, and internal infrastructure.

Collaborated with cloud, product, and vulnerability management teams for exploit-focused assessments.

• Developed repeatable testing methodologies for Kubernetes and container security reviews.
• Managed bug bounty triage pipeline while coordinating vulnerability lifecycle with researchers.
• Performed API security assessments for REST, GraphQL, and gRPC.
• Executed network penetration testing for internal and external environments.
• Led cloud security initiatives on AWS to enhance overall protection.
• Oversaw mobile application security assessments for iOS and Android platforms.

Led team of consultants in penetration tests across network infrastructure, web applications, APIs, and cloud environments.

Oversaw security operations and client engagements to ensure timely, high-quality technical delivery.

• Performed hands-on testing and strategic assessments, including phishing simulations and email security evaluations.
• Executed internal and external network penetration tests to identify vulnerabilities.
• Conducted cloud security assessments for AWS and Azure environments to strengthen defenses.
• Implemented web and API security testing strategies to mitigate risks associated with RESTful APIs.
• Contributed to methodology development and mentored junior team members to enhance expertise.
• Facilitated client engagement and reporting to communicate findings effectively.

Contributed to product security for international eSIM project, covering entire SDLC.

Conducted design reviews, threat modeling, and penetration testing for web and API services.

• Integrated security checks into CI/CD pipelines to enhance development processes.
• Advised development teams on secure coding practices during agile sprint cycles.
• Strengthened cloud security posture to support secure product delivery.
• Led product security initiatives for eSIM-based mobile network product.
• Executed RESTful API and web application penetration testing to identify vulnerabilities.
• Developed security documentation and provided advisory support for developers.

• Conducted penetration tests in LAN/WAN, web apps, social engineering, DDoS, and email gateway security.
• Managed and planned comprehensive penetration testing strategies to ensure thorough assessments.
• Identified and communicated vulnerabilities to customers, advising on prevention measures.
• Performed social engineering attacks to evaluate security awareness across organizations.

• Web Application Penetration Testing
• Local Network penetration tests