Software engineer building production Python services - an AI-powered log analyzer, SOC dashboard, and computer-vision pipeline - with Claude API and Orkes Conductor orchestration. Open to backend, AI engineering, and security tooling roles.
📍 Fremont, CA · 🎓 MS Computer Science, Stevens Institute of Technology
Languages
Backend & Data
ML & AI
Cloud & Infrastructure
Observability & Security
log-analyzer is a command-line tool that reads SSH auth.log, Windows Event Log CSVs, and Apache/Nginx access logs, flags brute-force attempts, port scans, and web scans, and tags each one with its MITRE ATT&CK technique. A rule engine catches the obvious patterns; an Isolation Forest model and a PyTorch autoencoder score the rest for anomalies (swap backends with --detector). The burst detector started as an O(n²) scan; I rewrote it as a two-pointer sweep over a time-sorted window and runtime on a 50k-line log dropped from 53 seconds to 0.8. It compiles detections to Splunk SPL, Elastic ES|QL, or Sentinel KQL; can push over REST or gRPC to SOC-Dashboard with OTel traces propagated end to end; bulk-indexes into Elasticsearch; publishes to Kafka; and runs a multi-step AI agent with MITRE ATT&CK STIX-based RAG retrieval. It has 372 tests at 90% line coverage, with K8s/Helm manifests, GCP/Terraform deployment, and a --gcs-bucket flag for optional GCS report upload.
SOC-Dashboard is the other end of that pipeline. Alerts arrive over REST (Flask) or gRPC (a Go ingest microservice), or from a Kafka consumer — all three converge in a severity-ranked queue analysts triage with one click. It tracks MTTR, SLA-breach rate, and escalation rate with Chart.js. SSE live updates broadcast over Redis pub/sub so every Gunicorn worker pushes queue changes in real time. pgvector semantic similarity (GET /api/alerts/<id>/similar) groups related incidents by cosine distance. The stats endpoint originally ran a correlated subquery once per row; I replaced it with a single aggregate join and latency dropped from 24ms to 12ms at 20,000 alerts. The /api/alerts endpoints support server-side pagination (LIMIT/OFFSET, idx_alerts_created_at index, paginated envelope) so the queue stays fast at any scale. It has 229 tests (142 pytest + 87 Go), K8s HPA manifests, and GCP/Terraform deployment.
Face-Tracking-System is a real-time face detector I built with Parshav. YOLOv8-nano is the primary detector; a Haar cascade takes over as a last-resort fallback if YOLO is unavailable or fails at runtime. NMS de-duplicates boxes; a 5-frame temporal filter suppresses one-frame false positives. If a GPU backend fails it falls from CUDA to OpenCL to CPU instead of crashing. Writing tests for the camera-failure path turned up a real bug: the recovery code called ErrorHandler.handle_camera_error without an instance, so every failure raised AttributeError instead of resetting the camera. It exposes the detector as a FastAPI service with per-IP rate limiting, a Prometheus /metrics endpoint, bounded concurrency that returns 503 on overflow, and Claude Haiku triage notes on low-confidence detections. It has 224 tests at 96% line coverage, with K8s HPA manifests that scale on CPU and the custom face_detection_backend_per_second metric, and GCP/Terraform deployment.
log-analyzer and SOC-Dashboard are one loop. One detects and sends what it finds over HTTP; the other is where a person triages it. I checked that handoff end to end with 125 pushes, all returning HTTP 201.
I was a Software Developer at Unique Design Inc. (Apr 2025 - Jul 2026), building SSIS pipelines that move 8M+ rows a day into AWS RDS for 250+ Tableau users and writing Splunk triage workflows. Before that I was a Software Engineer at Dianco Inc. in NYC, writing Python automation to parse and correlate firewall logs and building ETL pipelines to sync PostgreSQL e-commerce data into SQL Server. Full history on LinkedIn.
Languages Python, Go, C#, Java, Bash, SQL
Backend & Data Flask, FastAPI, gRPC, PostgreSQL, Redis, Elasticsearch, Kafka, SQL Server, SSIS ETL, psycopg2, pgvector
LLM & AI Claude API, Orkes Conductor, agentic tool-use workflows, RAG (fastembed + pgvector), concurrent batched LLM calls, token-cost / p50/p95 instrumentation, prompt engineering
Security MITRE ATT&CK mapping, Sigma and pySigma, Splunk / Elastic / Sentinel SIEM, Fernet encryption, HMAC, RBAC, threat-intel and GeoIP enrichment
Machine Learning & Vision scikit-learn (Isolation Forest), PyTorch (autoencoder), YOLOv8, OpenCV, Haar cascades, mediapipe
Observability OpenTelemetry (traces + OTLP export), Prometheus, structlog
Infrastructure Kubernetes, Helm, Terraform, GCP (Cloud Run, GKE, Cloud Storage), AWS (EC2, RDS, S3, Lambda), Azure IaaS, Docker, GitHub Actions
