Jeff L. Email & Phone Number

San Francisco, Ca, Us

As a Principal Engineer at Corelight, I lead the development and delivery of network traffic analysis components across multiple deployment platforms (physical and virtual) with a focus on Suricata delivery and high performance.As the Technical Lead for performance engineering, I am responsible for optimizing the performance of both existing and future hardware appliances. My role involves identifying and implementing enhancements that ensure high-performance, scalable solutions tailored to meet the demands of evolving network environments.As a member of the engineering leadership team, I help guide technological advancements and align initiatives to drive innovation across our sensor portfolio. In my capacity as Technical Lead for Suricata development and Zeek integration, I focus on optimizing traffic analysis performance across diverse deployment environments, leveraging my expertise in packet inspection frameworks.Additionally, I serve as the liaison between Corelight and the Open Information Security Foundation (OISF), ensuring Corelight’s technical needs are represented within the broader Suricata development community.

As a core Suricata developer, I contribute to several key aspects of Suricata’s development. My focus includes designing new features, improving the system’s performance and scalability, and ensuring its overall reliability.By thoroughly testing, conducting code reviews, and consistently optimizing, I help keep Suricata at the forefront of network threat detection. My passion for quality software and cybersecurity drives me to make meaningful contributions that help protect networks from attacks.I also collaborate closely with the wider Suricata community, always working to enhance the platform’s capabilities and address the new challenges faced by cybersecurity professionals around the world.

Pleasanton, California, Us

Member of the Cybershield development team. Collaborated with a fully remote team to design and implement high performant and secure software features.

San Francisco, Ca, Us

I led the integration of Suricata into Corelight’s network traffic sensors, enhancing the platform’s detection and analysis capabilities. As the technical lead for Suricata’s data plane integration, I ensured seamless functionality and improved performance.Additionally, I consulted on control plane integrations, offering expert guidance to optimize system architecture and efficiency. Leading a cross-functional team, I drove performance optimizations across all physical platforms, achieving unprecedented results in system performance for a system targeted for very high speed deployments (100Gbps)

San Francisco, Ca, Us

As part of the application team, I worked on developing network traffic analysis components for Corelight’s physical and virtual sensors. My role involved designing and integrating Zeek and Suricata to enhance Zeek’s log output across our entire sensor line.

Kirkland, Wa, Us

Member of the TanOS appliance development which provides the platform for Tanium software services.

Atlanta, Georgia, Us

I led the technical development of an internal tool that automates the rebuilding of machine learning models for a fraud detection product, improving efficiency and accuracy in call centers. By transforming ad-hoc scripts into a unified, installable package addressing multiple risk factors, I significantly enhanced the product’s fraud detection capabilities.In this role, I served as a direct contributor, architect, planner, and mentor, fostering a collaborative and innovative team environment. I worked closely with Pindrop’s engineering team to build a reliable, scalable framework for managing model configurations.I spearheaded the transition from scattered repositories to a structured system, developing a nightly testing framework for early detection of regressions. This improved model maintenance, reduced manual intervention at customer sites, and lowered operational costs, promoting scalability and continuous improvement.Additionally, I maintained clear and consistent project documentation, ensuring smooth knowledge transfer, and vigilantly proofread technical documents and code for accuracy.

Research and development for a high-speed embedded cybersecurity network device, enhancing network performance, scalability, and extensibility on multi-core hardware. As a founding member of the R-Scope cybersecurity group, I focused on zero-copy packet inspection and classification using the Bro engine and custom packet acquisition libraries.I designed and implemented a mechanism for streaming packet data to external sinks without copying, enabling selective pcap capture and improving data efficiency. My role also involved comprehensive system testing to ensure robust performance that met industry standards.In addition to providing front-line support for major customers at deployment sites, I engineered custom solutions using R-Scope for proof-of-concept scenarios, demonstrating the product’s versatility in addressing diverse client needs.

Burlington, Ma, Us

I developed and deployed high-speed (10Gbps) network protection appliances, focusing on driver development in multi-threaded, multi-process systems to enhance performance and scalability. My work included performance and reliability enhancements to data-path processing stages, enabling robust security analytics for network appliances.I architected countermeasures for Transport Layer Security (TLS) and HTTP authentication, implementing features such as JavaScript authentication challenges and TCP header value filtering. Additionally, I engineered a multi-threaded NetFlow processor for data gathering, significantly improving data processing efficiency.To optimize network performance, I modified 10G network drivers to support high-speed, zero-copy deep packet inspection. I also adapted Intel’s DPDK framework to integrate with Arbor’s zero-copy inspection framework on 10G and 1G systems.

Armonk, New York, Ny, Us

I continued the development of a project that I initiated within the Office of the CTO, advancing it to an early prototype stage and demonstrating both leadership and technical expertise. I assisted in early demonstrations of the technology to executive and engineering teams, effectively communicating complex concepts and gaining support for further development.As the de-facto subject matter expert in architecture, functionality, and operations, I provided critical insights to enhance project outcomes. I led cross-functional collaboration efforts to integrate diverse technical components, fostering innovation within the team.

Development of next-generation products incorporating advanced web security mechanisms, which significantly contributed to transitioning the project into an engineering team. I engineered software to detect JavaScript vulnerabilities, enhancing the capabilities of endpoint security scanners by extracting, compiling, and executing both obfuscated and non-obfuscated scripts in a sandbox environment.By implementing behavioral analysis techniques, the detection of 0-day and high-risk vulnerabilities, enhancing the security of web content scanning solutions. Working closely with the Office of the CTO, I aligned development efforts with strategic goals, leveraging cutting-edge technologies to drive product innovation.

Armonk, New York, Ny, Us

Intrusion Prevention Systems on high-speed network elements with focus on robustness, performance, and extensibility.Virtual and physical platforms on appliance, blade, 3rd party carrier class systems, and mainframe form factors.Created a hardware agnostic design and implementation for virtual and physical system deployments. Principal developer on Proventia Virtualized Network Security Platform.Cross-team and division architectural roles.Technical lead for joint development project with third-party hardware vendor

Redmond, Washington, Us

Visual Studio 2005 - Team Foundation server components. Server infrastructure including failure recovery, data mining, administrative, diagnostic, and activity logging for version 1.0 of Team Foundation Server Components (version control, work item tracking, project management).

Atlanta, Georgia, Us

One of the initial developers of Racemi's control and monitoring software for a internally-developed multi-blade chassis.

Hanover, Maryland, Us

Armonk, New York, Ny, Us

Created software for software-based network security intrusion detection system.

Project lead for disaster recovery software in CLARiiON's disk storage products. Multiple patents (see patent section) from this project.

Technical lead and individual contributor for several OEM projects to provide SecureWare's computer security product on UNIX platforms. Customer's included Hewlett-Packard, IBM, Open Software Foundation, Santa Cruz Operation.

Columbus, Oh, Us

Co-lead for file system architecture overhaul of System V to support multiprocessor systems as part of joint Unix System Laboratories-Sequent Computer Systems project. Developed and implemented architectural and implementation changes of System V file system components including buffer management, local and remote file system types, and related components such as cache-assisted directory searches.

Developed kernel mode software for local and remote file systems (e.g., NFS) for DG/UX.

Software development for low-level operation of cellular phone site controllers including bootstrapping and diagnostics.