AWS Security Incident Response
AWS · Founding Engineer and Technical Lead
Overview
I helped architect and build AWS Security Incident Response from the ground up, leading a team of 12+ people through its public launch at AWS re:Invent 2024. The service subsequently expanded to 15+ AWS Regions.
My work spanned distributed service architecture, ML-based finding triage for internal responders and agentic AI-powered investigation—using ML and GenAI to reduce manual work, guide responder actions and accelerate security investigations.
Key contributions
- Service architecture and cross-organization integrations: Helped architect the service and collaborated across AWS teams to deliver integrations with IAM for access control, AWS Organizations for account and organization integration, AWS Commerce Platform for service pricing, and AWS tagging infrastructure for resource tagging support.
- ML-based triage and responder guidance: Worked on ML-based filtering of Amazon GuardDuty findings for internal responders, filtering out findings assessed as non-issues and providing next-step guidance for pending findings or activity that could not be ruled out.
- Agentic investigation: Led the architecture and development of AI-powered investigation workflows that gathered and correlated evidence across AWS sources. Investigation first drafts took approximately 15 minutes, compared with 10–12 hours of manual work, with analysts reviewing and approving the findings.
- Flexible service coverage: Led organizational-unit-based membership, enabling customers to activate coverage for selected workloads and contributing approximately $1M in incremental revenue.
- Engineering leadership: Led technical reviews for public-facing API launches and championed agentic AI adoption across engineering teams.