Backend engineer building production Python services — an AI-powered log analyzer, SOC dashboard, and computer-vision pipeline — with Claude API and Orkes Conductor orchestration. Open to backend, AI engineering, and security tooling roles.

📍 Fremont, CA · 🎓 MS Computer Science, Stevens Institute of Technology

log-analyzer is a command-line tool that reads SSH auth.log, Windows Event Log CSVs, and Apache/Nginx access logs, then flags brute-force attempts, port scans, and web scans and tags each one with its MITRE ATT&CK technique. A rule engine catches the obvious patterns and an Isolation Forest model scores the rest for anomalies. The burst detector started as an O(n²) scan that compared every event against every other event; I rewrote it as a two-pointer sweep over a time-sorted window, and runtime on a 50k-line log dropped from 53 seconds to 0.8. It has 225 tests at 90% line coverage and can compile its detections to Splunk SPL, Elastic ES|QL, or Sentinel KQL.

SOC-Dashboard is the other end of that pipeline. log-analyzer POSTs each incident to its REST API, and the alerts land in a severity-ranked queue an analyst works through with one-click triage. It tracks MTTR, SLA-breach rate, and escalation rate, and draws them with Chart.js. The stats endpoint used to run a correlated subquery once per alert row; I replaced it with a single aggregate join and the query went from 24ms to 12ms at 20,000 alerts. It has 75 tests against a real PostgreSQL database at 95% line coverage.

Face-Tracking-System is a real-time face detector I built with Parshav. It runs a ResNet-SSD network and a Haar cascade together and merges the boxes with non-maximum suppression, since each catches faces the other misses. If a GPU backend fails it falls back from CUDA to OpenCL to CPU instead of crashing. Writing tests for the camera-failure path turned up a real bug: the recovery code called ErrorHandler.handle_camera_error without an instance bound to it, so every camera failure raised an AttributeError instead of resetting the camera. It exposes the detector as a production REST API with per-IP rate limiting, a Prometheus /metrics endpoint, bounded concurrency via a slot counter that returns 503 on overflow, and Claude Haiku triage notes on low-confidence detections. It has 224 tests at 96% line coverage.

log-analyzer and SOC-Dashboard are one loop. One detects and sends what it finds over HTTP; the other is where a person triages it. I checked that handoff end to end with 125 pushes, all returning HTTP 201.

I'm an IT Analyst at Unique Design Inc., building SSIS pipelines that move 8M+ rows a day into AWS RDS for 250+ Tableau users, plus Splunk triage. Before that I was at Dianco Inc. in NYC. Full history on LinkedIn.

Languages: Python, C#, Bash, SQL Backend and data: Flask, FastAPI, PostgreSQL, SQL Server, SSIS ETL, psycopg2 Security: MITRE ATT&CK mapping, Sigma and pySigma, Splunk, Fernet encryption, threat-intel and GeoIP enrichment Machine learning and vision: scikit-learn (Isolation Forest), OpenCV, ResNet-SSD, Haar cascades Infrastructure: Docker, GitHub Actions, AWS RDS, Azure IaaS