Okan YILDIZ

About

Security engineer with 10 years across application, cloud, infrastructure and AI security. Currently Staff Security Engineer at Depop (an eBay company), where I lead application, cloud, infrastructure and AI security engineering alongside the Information Security team. Previously Principal Product Security Engineer at Marks & Spencer and Lead Security Engineer & Architect at SITA, and before that seven years at an email security start-up as a founding engineer and later engineering lead of a 20+ person team.I build security into engineering rather than around it: DevSecOps pipelines that catch risky dependencies and leaked secrets at the pull request, hardened container images with detection built in, cloud guardrails that stop misconfiguration before it ships, and vulnerability management run on clear SLAs. I stay hands-on with threat modelling, web, mobile and API penetration testing, software supply chain security and incident response, and I automate the repetitive parts in Python and Go.A growing part of my work is AI security: threat modelling LLM and agent based systems, security guardrails for AI coding assistants, MCP server assessment, AI red teaming, and MLSecOps controls for models and pipelines. I write about this in my Built to Secure newsletter and on Medium.Outside work I run Nullhaus, a free, volunteer-led technology education project with no fees, sponsors, ads or paywall, built for students, career changers and engineers without a local network. It runs invitation-based practitioner sessions across eight pillars, led by security, and publishes everything openly at nullhaus.org: recordings, field guides, briefings and primers. Before that I founded UniqueSec, a volunteer security community that reached 3,000+ people in 50+ countries. Earlier research includes a DNS tunnelling tool that bypassed widely deployed enterprise DNS defences. I hold CEH, ECIH, CASE .NET, CTIA, APT and CCISO.