Projects

The problem

Large organizations run many systems that each partially "know" their devices — EDR, vulnerability scanning, the CMDB, config management, SIEM, Active Directory. None of them agree. The same laptop appears under different names with conflicting OS, owner, and location data, and no single system holds the full picture. Basic questions — how many assets do we actually have, and which are missing security coverage? — become nearly unanswerable.

What I built

AssetIntel ingests every source on a schedule, deduplicates and resolves the records into one golden asset, computes a reconciled winning value for each attribute across sources, and evaluates boolean assertions — has an active EDR agent, onboarded in Defender, missing from the CMDB — to surface coverage gaps. It all surfaces through a real-time operations dashboard.

Engineering highlights

• Pluggable connector framework CrowdStrike, Microsoft Defender, ServiceNow, SCCM, Qualys, QRadar, Active Directory, and CSV — each handling its own auth (OAuth2 client-credentials, API tokens, Windows net-only launch) and pagination.
• Two-stage, wave-orchestrated sync Stage A fetches per source; Stage B reconciles the whole tenant — entity resolution, winner computation, assertion evaluation, cross-source linking. A wave model serializes shared derived-state work so concurrent syncs can't corrupt it.
• Derived-state coherence engine Generation counters and completion records guarantee reports never read half-computed state, backed by a coherence audit and self-healing recompute.
• Security and reliability Field-level credential encryption with a deployment- and identity-independent key, a closed failure-reason taxonomy, per-phase timing telemetry, and live sync logs that show exactly why a sync failed.
• Performance at scale Profiled and optimized the multi-hour full-tenant recompute — a change-detection guard eliminated roughly 1.27 million redundant row writes per sync, and no-op syncs now skip recompute entirely.

Role

Co-architect and engineer on a two-person build.

The problem

A DLP team could see alerts, but not answer the question that actually mattered: when we tune a policy to stop a false positive, does that change reach the machine that reported it? Triage lived in spreadsheets and chat threads, tuning targets were picked by hand, and a fix aimed at the wrong policy file variant looked identical to a fix that worked.

What I built

DLPViz ingests the DLP export feed into partitioned event tables, tracks issues and per-file tuning recommendations through a ticketed workflow, and makes reachability a first-class field on every issue. An AI investigator agent runs diagnostics on reporting hosts and posts structured findings back through an authenticated API, so the loop from alert to verified fix closes inside one tool.

Selected engineering

• Partitioned ingest at scale A long-lived ingest daemon holds a persistent database session coordinated by per-process advisory locks and a heartbeat singleton. Hash-partitioned event tables keep dashboard queries under a second at multi-million-row scale.
• Query performance under contention An overview page ran a COUNT(*) that took over 52 minutes while bulk loads held locks. Switching to a row-estimate path brought it to 3.9 seconds with ingest still running.
• Type-scoped resolution of false ambiguity Each host resolves to a different effective policy file per resource type, and the vendor API returns one arbitrary cross-type pick. A per-type resolver maps an issue's category to the right resource family and selects the correct file — unblocking a whole class of tickets stuck behind false ambiguity flags.
• Shadow-pair schema with forward-only sync Approving a suggestion in one file's ledger auto-advances its paired shadow entry in the canonical file's ledger, via a self-referential foreign key and a sticky status maximum. It never demotes across the pair, and the emit path is idempotent.
• Reach as a first-class question Every issue panel renders a host → pulls → targets chain and a matrix of per-type files with tuning counts, then intercepts "wrong file" close attempts with a guardrail modal — catching the case where a live tuning targets the wrong file variant for the reporting host.
• Isolation-tolerant collector pattern The application has no direct route to the upstream vendor database, so scheduled PowerShell collectors publish JSON manifests to a shared drop the site reads. A change beacon closes the loop back to the investigator agent, stamping delivery on read.
• Agent integration A token-authenticated API lets a Claude-based investigator agent run probes on reporting hosts, post structured findings, and emit risk-classified tuning recommendations. An async mailbox endpoint carries design questions between the server and the agent.

Role

Sole engineer — designed and built the platform end to end: ingest, data model, workflow, front end, and the agent-facing API.