I've moved over to the AWS Glue Elastic Views team!

At AWS Crypto Tools, I helped AWS customers and service owners implement best practices for cryptography in their software.

At AWS Crypto Tools, I helped AWS customers and service owners implement best practices for cryptography in their software.

While continuing to support Amazon’s anti-DDoS efforts, I also drove resilience into the Amazon SOA graph, pushing systems to recover automatically from failure. I identified an 8-figure source of waste and wrote a new filesystem to eliminate it. I automated the creation of common, missing alarming company-wide. I rearchitected the consumer business’s most critical service to never die under heavy load while taking half as much hardware. Most importantly, I ensured a successful Prime Day, Black Friday, and Cyber Monday 2020. I was the call leader during these events, in charge of the 500+ people on the war room call.

I transferred myself onto the Spillways team to tackle the debottlenecking of a critical service that had slowed me and other teams down in my previous role; the service was the frontend proxy for all of Amazon consumer’s incoming traffic. I pushed to deprecate the entire service in favor of extension points in AWS products we could plug into, and worked with teams across the company to make it happen. I also led the release of a management layer for HTTP request routing changes to automate most of the operational work of the service, cutting 1.25 FTE.As part of this role I also took the lead on closing a number of security and availability risks in the existing service, leaving Amazon consumer’s anti-DDoS systems in a world class status. I tackled thorny security and privacy issues as we moved behind a CDN, and as Amazon expanded into new businesses with stricter regulatory requirements. I was also the point engineer for the consumer business’s response to the Symantec CA shutdown, advising directors and VPs across the company on our strategy, and supporting the migration to a new CA by building an A/B testing framework for SSL/TLS handshakes.

I was the lead engineer for Secure Ingestion, a critical security platform service that protected all inbound and outbound critical data exchanged with customers (credit cards, tax ID #s, etc.). As part of this I built a system to scan for and decrypt data in a compressed stream for efficiency (US Patent #10,516,764); I did this in a way that provided hard isolation between components such that it was hard for an attacker to cause data loss by breaking any one isolated component.I was the point of contact for this area’s annual PCI audit from 2011 to 2017, working with auditors who often had not seen this model before.I am ashamed to admit that I built an nginx module that made a remote service call to rewrite the request body as a way of replacing critical data with tokens rather than encrypted blobs. I later gave a talk out our in internal security conference on why you should never attempt this. It successfully supported the launch of buying cell phones with a credit check in multiple countries.I also took the proxy service from the previous section and fixed 10 years of dependency hell, upgrading it to build with a modern compiler, folding multiple separately deployed services into one environment to ensure strong consistency, and getting a 10% performance improvement in the process – in 12 days. I transferred myself onto the proxy team when they delayed its launch for 6 months due to a lack of testing.

I was the original and lead engineer for the Secure Ingestion service, the critical security service mentioned above. I produced the original design, reviewed it with the principal engineer community, and got buy in as we hired the rest of the team in Romania. I led the team remotely from Seattle, as we built a system scaled to protect all Amazon consumer critical data, with stringent security requirements. For example, we built a deployment validator that interacted with SELinux in such a way that we could use Amazon’s internal deployment system without trusting it to be uncompromised.We moved from a minimal-but-secure product to a full featured multitenant system, while adding anti-DDoS features, and integrating with iteratively more Amazon systems. I took the distributed TLS session cache (US Patent #9,064,124 and 9,166,862) and released it internally for any Amazon consumers of nginx. As a result, we increased security for our customers while simultaneously lowering their website latency.

I migrated AWS billing logic from their legacy C++-based bill computation service to the next generation Java system, while ensuring it produced the same results using (and expanding) our massive test suite. I added support for billing for AWS Marketplace, where AWS acts as a reseller and bills on behalf of ISVs and SAs. I shepherded 7 of our monthly bill runs.

Supporting Amazon Webstore, Amazon’s “eCommerce site as a service” offering, I designed and built an ISV-facing API for third parties to add extensions to their website, allowing them to interact with backend Search, Browse, Detail, and Cart systems. This was critical in attracting customers who wanted to use Webstore but were missing a few smaller features they really needed.I added support for guest checkout to Target.com (then hosted by Amazon), encompassing changes across our Java and Perl rendering platforms, and the C++/Perl customer service platform so that CS reps could still help customers without accounts. I added audio previews for music CD purchases, and reskinned lots of the Target.com detail page.

I supported Mothercare, Marks & Spencer, Bebe.com, and Target in the migrations from the older Perl rendering platforms to the next generation Java platform. I reskinned most of the Mothercare website to their spec. I also built a feed processor to sync up with Bebe about their inventory.

In college I was the sole employee of OpenTeams, a startup aimed at building an online collaboration suite with a model similar to a wiki whose nodes could be mixed into collaboratively edited presentations, lists, and similar. I am ashamed to admit this was written in PHP.

Administered a Netware Network and attached client systems in an educational environment.