Radio Frequency & Electronic Warfare Engineer — Signal Intelligence, SDR, cellular protocol analysis.

I work on the lower and legacy layers of the cellular stack — the ones with little or no open-source coverage. Passive receiver chains from raw IQ to decoded signaling, rogue-infrastructure detection, and controlled attack environments for defensive research. Currently in the defense industry: RF/EW, SIGINT, and tactical communications across the 700 MHz – 6 GHz range.

The work here is the independent side of that: taking 2G, 3G, and 4G radio protocols apart down to the bit.

• Passive cellular decoding — PHY to L3: cell search, channel coding, ASN.1 (UPER)
• SDR signal processing — USRP, LimeSDR, HackRF, RTL-SDR via GNU Radio / SoapySDR
• Rogue base station and IMSI-catcher analysis and detection
• Direction finding, spectrum monitoring, GNSS denial

wcdma-decoder · Python · 3G A complete passive WCDMA receiver: raw IQ to decoded RRC system information. P-SCH/S-SCH cell search, CPICH channel estimation, a vectorized R=1/2 K=9 Viterbi decoder, and ASN.1 UPER parsing of MIB and SIB3/5/11/11bis/19 per 3GPP TS 25.331. The WCDMA broadcast layer is absent from srsRAN and Osmocom; this fills it. Validated on a live Band 1 network across five active UARFCNs.

gsm-neighbor-scanner · Python · 2G Decodes GSM System Information from any BCCH, resolves neighbor-cell allocations, and maps network topology to CSV, JSON, and PCAP. Dynamic early-termination reduces scan time from roughly 25 seconds to 3–4.

lte-hold-uplink · C · 4G A handover-redirect rogue eNodeB built on OpenAirInterface, staged against a legitimate cell and EPC core. Built as a reference attack environment for the detection systems designed to catch it.

Languages — Python C / C++

Radio & Tooling — GNU Radio Embedded Linux SoapySDR srsRAN OpenAirInterface Open5GS Osmocom Wireshark TEMS

Protocols — 5G NR LTE WCDMA/UMTS GSM NAS RRC ASN.1 (UPER)

Ankara, Turkey · LinkedIn · akalinkutay@gmail.com