# Engineering-led security for the systems you build and run. > Security engineering for applications and cloud: secure architecture, IAM, central logging, vulnerability management and incident readiness. Source: https://www.algofact.tech/en/services/cloud/cybersecurity Language: en-US Updated: 2026-10-26 Languages: en-US, tr-TR ALGOFACT treats application and cloud security as engineering work: we design secure architecture, clean up identity and access management, set up central logging and vulnerability management, and prepare your team for a security incident. Penetration tests are carried out by independent testing firms that we coordinate, and we close the findings in code and infrastructure. The work is delivered from our engineering offices in Adana and Ankara TEKMER, Türkiye, under an ISO 27001:2022 certified information security management system. ## Key facts - **Focus:** Application, cloud and CI/CD security - **Identity and access:** Least privilege, MFA, role-based access - **Penetration testing:** Coordinated with independent testers - **Incident readiness:** Response plan, runbooks and tabletop exercises - **Privacy:** GDPR and KVKK handled at design time - **Information security:** ISO 27001:2022 certified security management ## When is this the right service? When an enterprise customer sends a security questionnaire, an audit is coming up, findings from past penetration tests are still open, or nobody can say who has access to what in your cloud accounts, security becomes work for your software and infrastructure team. That is where this service fits: we close risks through changes to architecture, code and configuration. We keep the scope explicit. ALGOFACT does not position itself as a security operations center (SOC) or a managed security service provider (MSSP). Penetration tests are run by independent firms; we prepare the scope, coordinate the test and fix what it finds. If you need round-the-clock security monitoring, we build the integration that sends your logs to the SOC provider you choose. Security work can be a project on its own, or the technical side of a system we build, a cloud migration or preparation for ISO 27001 and privacy compliance. Among the use cases on our /work page is Letoon, a private hospital for which ALGOFACT delivered hospital management system software and security infrastructure. ## What we cover The doors attackers use most often on the software and cloud side. ### Secure architecture and threat modeling For a new system or a major change, we draw the data flows, identify where an attacker could get in and decide what must be protected. Those decisions are made at design time, not patched in later. ### Identity and access management Least privilege, multi-factor authentication, single sign-on and timely removal of leavers’ access across cloud accounts, code repositories, databases and admin consoles. ### Logging and audit trail Application, infrastructure and access logs are collected centrally, tamper resistant and retained as long as required. Alerts cover events such as suspicious sign-ins or permission changes. ### Vulnerability management Dependency and container image scanning, static code analysis, cloud configuration review and a patch schedule. Findings are ranked by severity and tracked until they are closed. ### Penetration test coordination We write the test scope and rules of engagement and prepare the environment and access. Findings in the independent tester’s report are fixed in code and infrastructure and made ready for a retest. ### Incident readiness An incident response plan, a communication chain, restore procedures and tabletop exercises, so who does what during an incident is written down before it happens. ## How the work runs ### Current state review We review architecture, access, logging, backups and open findings. Earlier penetration test reports and audit findings, if you have them, are the starting point. ### Risk ranking Findings are ranked by likelihood and impact. Quick fixes and risks that need architectural change are planned separately. ### Remediation Configuration, code and infrastructure changes go through review and the pipeline. Each change is recorded with the risk it closes. ### Verification Closed findings are tested again, and a retest with the independent firm is scheduled when needed. ### Continuous controls Scans and configuration checks are added to the pipeline, so security does not end as a one-off project. ## What you receive ### Security assessment report Findings, risk ranking and a remediation plan. ### Threat model and architecture decisions Data flows, trust boundaries and the reasoning behind each security decision. ### Access matrix A current list of which role reaches which system with which permissions. ### Log sources and alert rules Collected logs, retention periods and alert conditions. ### Incident response plan Incident classes, owners, communication steps and technical response procedures. ### Audit evidence pack Configuration and process evidence for ISO 27001, GDPR, KVKK or customer security questionnaires. ## Who does what If security responsibilities are not written down at the start, the most critical task falls between the cracks. - **ALGOFACT:** Secure architecture, access and logging design, vulnerability scanning and patch management, fixing findings in code and infrastructure, and preparing the incident response plan and exercises. - **Independent testing firm:** Penetration testing. Regulated sectors such as finance and the public sector may require the test to be done by an accredited firm; you choose the firm and we handle the coordination. - **SOC provider:** Round-the-clock security monitoring and alert triage. If you need it, we set up the log forwarding and the alert flow. - **Your team:** Risk acceptance, budget priorities and the decision on when each finding gets closed. Decisions are recorded in writing. ## Questions about software and cloud security ### Do you perform penetration tests yourselves? No. An independent testing firm runs the penetration test, which also keeps the findings impartial. We prepare the scope, environment and access, fix the findings in the report and get the system ready for a retest. ### Do you provide round-the-clock security monitoring? Continuous monitoring and alert triage are SOC services, and we do not offer them. If you need them, we configure your log sources and alert rules to feed the platform of the SOC provider you choose. ### We are not ISO 27001 certified yet. Does this work help? We put a large share of the technical controls in place, including access management, logging, vulnerability management, backups and incident response, and prepare the evidence. Setting up the management system and preparing for certification is a separate Technology Assessment engagement. ### What happens if we have a security incident? The response plan we prepared kicks in. For systems we built or support, we take part in technical steps such as revoking access, isolating systems, restoring from backup and root cause analysis, within the scope defined in the contract. If forensic investigation is needed, we recommend working with a specialist firm. ### Can you help us answer customer security questionnaires? Yes. Enterprise questionnaires mostly ask about access, encryption, logging and incident management. We implement the controls behind the answers and prepare the evidence that supports them. ### What drives the timeline and cost of security work? The number of systems and cloud accounts, the maturity of existing controls, the number of open findings, the compliance goal and how much of the remediation your team will do. After the review we present the risk ranking, remediation plan and phases in writing. ## Related - [Cloud](https://www.algofact.tech/en/services/cloud) - [DevOps and CI/CD](https://www.algofact.tech/en/services/cloud/devops) - [KVKK and ISO 27001 compliance](https://www.algofact.tech/en/services/technology-assessment/kvkk-iso27001-compliance) - [Discovery call](https://www.algofact.tech/en/contact)