• Presented multiple design docs to a team of 11, gathered early feedback and interacted with internal partner team to use their service
• Designed an automated solution combining network data flow with historical threat intelligence to detect new AWS resources communicating with malicious Command & Control Servers (C2s). Used Infrastructure as Code to deploy the cloud service [Python, AWS Lambda, DynamoDB, Amazon Neptune, EventBridge, AWS CDK, TypeScript]
• Built stream processing application that aggregates 250,000 data from network telemetry down to 50 entries to be injected to DB daily, thereby reducing cost of storage by storing summary of data [Apache Flink, Java, Kinesis Data Analytics, Kinesis Streams]
• Ran queries against graph database to determine what AWS resources communicating with C2s are reported by the threat intelligence and notified customers through notification service [Gremlin, Amazon Neptune, Amazon SNS]
더보기