Siber Güvenlik Uzmanı - Genel Sorular

Siber Güvenlik Uzmanı 10 soru 06.04.2026
Bu sorular ve cevaplar genel bilgilendirme ve mülakat hazırlık amaçlıdır. Gerçek mülakat sorularını yansıtmaz.
1

Siber güvenlik kariyerinize nasıl başladınız? En önemli gelişim alanınız nedir?

Bu soruya adayın kişisel deneyimini paylaşması beklenir. Örnek: "Üniversitede bilgisayar bilimleri okurken CTF yarışmalarına katıldım. Network security alanında uzmanlaşmak istedim. Sertifikalar aldım (CISSP, CEH, OSCP). En önemli gelişim alanım: Offensive security'den defensive security'ye geçiş ve threat intelligence."
2

OWASP Top 10 hakkında bilgi verir misiniz? En kritik güvenlik açıkları nelerdir?

OWASP Top 10: 1) Broken Access Control, 2) Cryptographic Failures, 3) Injection (SQL, NoSQL, OS), 4) Insecure Design, 5) Security Misconfiguration, 6) Vulnerable/Outdated Components, 7) Identification/Authentication Failures, 8) Software/Data Integrity Failures, 9) Security Logging/Monitoring Failures, 10) Server-Side Request Forgery.
3

Network security katmanlarınız nelerdir? Defense in depth approach nasıl uygularsınız?

Katmanlar: 1) Perimeter security (Firewall, WAF), 2) Network segmentation (VLAN, subnet), 3) Host security (Antivirus, EDR), 4) Application security (Code review, penetration testing), 5) Data security (Encryption, DLP). Defense in depth: Multiple controls, redundancy, zero trust architecture.
4

Security incident response process'iniz nasıl çalışır?

NIST framework: 1) Preparation (IR plan, tools, training), 2) Detection/Analysis (Monitoring, alerting, investigation), 3) Containment/Eradication (Isolate systems, remove threats), 4) Recovery (Restore systems, verify), 5) Post-incident activity (Lessons learned, improvements). Tools: SIEM, EDR, forensic tools.
5

Risk assessment nasıl yaparsınız? Risk scoring methodology?

Risk = Likelihood × Impact. Methodology: Asset identification → Threat analysis → Vulnerability assessment → Risk calculation → Risk treatment. Qualitative (High/Medium/Low) ve quantitative ($$) analysis. Risk register, risk appetite definition. Controls selection: Cost-benefit analysis.
6

Security awareness training programınız nasıl?

Program: 1) Onboarding training, 2) Regular phishing simulations, 3) Monthly security newsletters, 4) Annual refresher training, 5) Role-specific training (developers, executives). Metrics: Click rate reduction, reporting rate increase. Culture: Security champions program.
7

Compliance requirements (GDPR, HIPAA, SOC2) nasıl yönetirsiniz?

Compliance framework: 1) Gap analysis, 2) Control implementation, 3) Documentation, 4) Regular audits, 5) Continuous monitoring. GDPR: Data protection impact assessment, consent management. HIPAA: PHI safeguards, BAA. SOC2: Trust principles (security, availability, processing integrity).
8

Vendor/third-party security assessment nasıl yaparsınız?

Process: 1) Vendor inventory, 2) Risk classification (data access, criticality), 3) Questionnaire (CAIQ, SIG), 4) Evidence review, 5) On-site assessment (high-risk vendors), 6) Continuous monitoring. Contract clauses: Security requirements, right to audit. Incident response coordination.
9

Security metrics ve KPI'leriniz nelerdir?

Metrics: MTTD (Mean Time To Detect), MTTR (Mean Time To Respond), patch compliance rate, vulnerability age, phishing click rate, training completion rate. Leading indicators: Security posture assessment, penetration testing findings. Lagging indicators: Incident count, data breach cost.
10

Emerging threats nasıl takip edersiniz? Threat intelligence programınız?

Sources: Industry reports (Verizon DBIR, FireEye), vendor advisories, threat intelligence feeds (STIX/TAXII), ISAC participation. Internal: Threat hunting, anomaly detection. Dissemination: Executive summaries, technical briefings, integration with security tools (SIEM).