Software engineer building production Python services - an AI-powered log analyzer, SOC dashboard, and computer-vision pipeline - with Claude API and Orkes Conductor orchestration. Open to backend, AI engineering, and security tooling roles.
📍 Fremont, CA · 🎓 MS Computer Science, Stevens Institute of Technology
log-analyzer is a command-line tool that reads SSH auth.log, Windows Event Log CSVs, and Apache/Nginx access logs, flags brute-force attempts, port scans, and web scans, and tags each one with its MITRE ATT&CK technique. A rule engine catches the obvious patterns; an Isolation Forest model and a PyTorch autoencoder score the rest for anomalies (swap backends with --detector). The burst detector started as an O(n²) scan; I rewrote it as a two-pointer sweep over a time-sorted window and runtime on a 50k-line log dropped from 53 seconds to 0.8. It compiles detections to Splunk SPL, Elastic ES|QL, or Sentinel KQL; can push over REST or gRPC to SOC-Dashboard with OTel traces propagated end to end; bulk-indexes into Elasticsearch; publishes to Kafka; and runs a multi-step AI agent with MITRE ATT&CK STIX-based RAG retrieval. It has 361 tests at 90% line coverage, with K8s/Helm manifests and GCP/Terraform for deployment.
SOC-Dashboard is the other end of that pipeline. Alerts arrive over REST (Flask) or gRPC (a Go ingest microservice), or from a Kafka consumer — all three converge in a severity-ranked queue analysts triage with one click. It tracks MTTR, SLA-breach rate, and escalation rate with Chart.js. SSE live updates broadcast over Redis pub/sub so every Gunicorn worker pushes queue changes in real time. pgvector semantic similarity (GET /api/alerts/<id>/similar) groups related incidents by cosine distance. The stats endpoint originally ran a correlated subquery once per row; I replaced it with a single aggregate join and latency dropped from 24ms to 12ms at 20,000 alerts. It has 203 tests (116 Python + 87 Go), K8s HPA manifests, and GCP/Terraform deployment.
Face-Tracking-System is a real-time face detector I built with Parshav. YOLOv8-nano is the primary detector; a Haar cascade takes over as a last-resort fallback if YOLO is unavailable or fails at runtime. NMS de-duplicates boxes; a 5-frame temporal filter suppresses one-frame false positives. If a GPU backend fails it falls from CUDA to OpenCL to CPU instead of crashing. Writing tests for the camera-failure path turned up a real bug: the recovery code called ErrorHandler.handle_camera_error without an instance, so every failure raised AttributeError instead of resetting the camera. It exposes the detector as a FastAPI service with per-IP rate limiting, a Prometheus /metrics endpoint, bounded concurrency that returns 503 on overflow, and Claude Haiku triage notes on low-confidence detections. It has 224 tests at 96% line coverage, with K8s HPA manifests that scale on CPU and the custom face_detection_backend_per_second metric, and GCP/Terraform deployment.
log-analyzer and SOC-Dashboard are one loop. One detects and sends what it finds over HTTP; the other is where a person triages it. I checked that handoff end to end with 125 pushes, all returning HTTP 201.
I was a Software Developer at Unique Design Inc. (Apr 2025 - Jul 2026), building SSIS pipelines that move 8M+ rows a day into AWS RDS for 250+ Tableau users and writing Splunk triage workflows. Before that I was a Software Engineer at Dianco Inc. in NYC, writing Python automation to parse and correlate firewall logs and building ETL pipelines to sync PostgreSQL e-commerce data into SQL Server. Full history on LinkedIn.
Languages: Python, Go, C#, Bash, SQL Backend and data: Flask, FastAPI, gRPC, PostgreSQL, Redis, Elasticsearch, Kafka, SQL Server, SSIS ETL, psycopg2, pgvector Security: MITRE ATT&CK mapping, Sigma and pySigma, Splunk, Fernet encryption, threat-intel and GeoIP enrichment Machine learning and vision: scikit-learn (Isolation Forest), PyTorch, YOLOv8, OpenCV, Haar cascades Observability: OpenTelemetry (traces + OTLP export), Prometheus, structlog Infrastructure: Kubernetes, Terraform, GCP (Cloud Run + Cloud Build), AWS RDS, Azure IaaS, Docker, GitHub Actions
