Each entry names my role. The related architecture studies are illustrative designs, separate from workplace implementations.
Security & investigation
Shadow AI discovery & remediation
Built
Built a wrapper around open-source tools, including Cisco AI BOM, to support identifying and addressing unmanaged AI use.
SIEM & security data
Architected & built
Security-event ingestion, search, analytical storage, and detection integrations, from proof of concept through production implementation.
Detection workbenches
Built
Python detection and hunting applications, including run history, ad hoc execution, exports, and operating controls.
UEBA & insider-threat analytics
Co-developed & evaluated
Helped develop an internal behavior analytics capability, shaped investigation use cases, and evaluated commercial tools and detections.
Asset & exposure context
Integrated & contributed
Built security-data integrations and enrichment utilities; contributed to asset reconciliation, graph investigation APIs, and analyst usability.
Developer security tools
Built
An editor extension and command-line tools that bring security workflows into the development environment.
Data & governance
Lakehouse & query federation
Designed & implemented
Query platforms, analytical storage integration, and the work of moving from a proof of concept into an operating service.
Catalogs & metadata services
Engineering & integration
Data cataloging, metadata services, connectors, and synchronization, including a custom metadata layer using OpenMetadata.
Data APIs & compatibility tools
Built
Warehouse APIs, bulk export endpoints, reusable application components, schema inspection, and query-dialect utilities.
Telemetry & data quality
Built
Source-to-destination reconciliation, pipeline metrics, tracing, schema checks, and reporting that helps teams find incomplete or broken data flows.
Applications & automation
Enterprise search
Built
A custom search application with its own backend, middleware APIs, and reusable components for other applications.
Self-service data tools
Built
Upload-to-warehouse tools, query and reporting interfaces, configuration utilities, and interfaces for injecting synthetic test events.
Jobs & notifications
Built
Services connecting schedulers, scripts, mailboxes, ticketing, and notifications, with reusable APIs for other teams.
OAuth integration · articleReference-data services
Built
Scheduled reference-data refreshes, network and geolocation lookups, and APIs that make the resulting data easier to use.
Waldo · design notesPlatforms & development
Container platforms
Introduced & implemented
Kubernetes adoption, service packaging, platform integrations, monitoring, and the operational work around shared workloads.
Browser development environments
Built around open source
Delivered and managed browser-based developer environments using an existing open-source editor, with access to development tools and data.
Deployment & database changes
Engineering & product ownership
Built database deployment automation and helped define requirements, roadmaps, and service adoption for continuous delivery.
Technology evaluation
Prototyped & assessed
Evaluated database operators, query engines, metadata platforms, and deployment approaches. Some evaluations remained proofs of concept.
Product & service delivery
Business applications
Analysis & implementation support
Requirements, interfaces, acceptance testing, and release planning, alongside data-mart access, application enhancements, and operational support.
Infrastructure lifecycle
Service ownership
Mapped dependencies and ownership, planned migrations and retirement, and coordinated application teams, service providers, and operational reporting.
Technical enablement
Guidance & integration
Created reusable foundations, helped colleagues integrate them, reviewed designs and usability, and supported teams adopting new tools and ways of working.
AI & independent tools
Analytics & investigation agents
Built & prototyped
Conversational data applications, query and visualization agents, entity investigation tools, and integrations through APIs and MCP.
Rubberband · design notesMessaging assistants
Built
Koel, a privately hosted WhatsApp assistant that brings conversational context and MCP tools into messaging.
Koel · design notesAI serving & administration
Engineering & integration
AI serving with ClickHouse, gateway integrations, usage dashboards, identity-linked access tooling, redaction services, and agent release administration. Emergency-stop controls were prototyped.
Knowledge-base delivery
Built
A self-hosted service for managing and serving knowledge-base artifacts to Kibana AI Assistant.
Artifact server · sourceEvaluation applications
Built & customized
Tools for document parsing, retrieval, chat quality, security-profile checks, and model-service load testing.
Document, media & desktop tools
Built & explored
File inspection, PDF extraction, media analysis, screen capture, and utility applications for energy and location data.
FrameForge · sourceWorkflow & data experiments
Independent prototypes
Recorded browser workflows, generated applications and documents, and tools for transforming sensitive datasets. These are experiments with different levels of maturity.