In this role I grew a lot as a builder and an architect in a matrixed organization.

In Security Technology Group (STG) BU, the product Client-side Protection and Compliance (CPC) faced scale challenges with traffic growing from 200 events per second to 1 million events per seconds. Some of these learnings became BU template.

Customer-facing config API:

API designed with automation-first approach. Also scalable backpressure framework withstands high polling rate (at times, per minute) from customer SIEM integrations.

Edge cache and protection bundle:

Protection within web page is handled by a JS bundled which is injected at the CDN edge. Caching helps minimize user visible page load latency.

Script Inventory:

This feature is a PCI-DSS 4 requirement, an inventory of all the JS scripts running across payment pages. Traditionally, this list is discovered as a byproduct of analytics data pipelines. In order to make this customer-presentable and to allow operations like defining justification rules, customer-visible data source needs to be in sync with the analytics pipeline. The complication is, analytics pipelines process a million events per second. So the initial implementation with RDBMS eventually hit bottlenecks. This required architectural change to No-SQL databases while relaxing transactional guarantees from different operations. This project kickstarted architecture paradigm shift within the BU for workloads with high data volume and high write volume.

Data analytics pipelines

Initial MVP only had analytics pipeline to classify script behavior patterns, mostly for detecting sensitive data skimming. Later on as we developed more analytics for discovery of sensitive data fields, payment pages (later extended to discovering all paths with any sensitive data field), general SIEM capabilities and with the growth of web traffic protected, we required different design changes to customer config and CDN injection as well.

Tech lead for CDN "control plane". In this role I learned to architect performant large scale distributed systems and developed soft skills for cross-functional technical leadership.

CDN Config Managemet:

• RESTful microservices to facilitate retrieval, update, version control, validation and distribution of config (control plane) for CDN dependent and independent features.

• Implemented a generic and easily extensible validation platform for

• Reduced end-to-end deployment time by 75%

CDN cache management:

• Set of microservices communicating over message queues for validating, distributing and handling cache purge operations.

• Reduced end-to-end completion time by ~80%

• Provisioned for high availability

Authentication/Authorization:

• RBAC subsystem for user interaction with control plan platform.

• API gateway pattern to simplify architecture.

SSL certificate/key provisioning:

• Subsystem to securely generate SSL keys and procure and distribute keys and certificates to edge proxies.

In Feb 2020, Instart business and IP were acquired by Akamai, Inc.

Work on HostAgent, which is the lowest layer of management stack and acts as communication module between ESX/vSphere host and higher management layer (typically vCenter Server)

Work on various features relates to VM management, host management and scalability.

Packet Data Architecture (IPv6) in UMTS networks.

Worked on communication module between WCDMA chipset and higher layers.

Gained hands-on experience with performance modeling of mobile network using Agilent box

CSC 474