Nov 2021 — PresentCurrent
Software Engineer III
Ericsson
Owns platform-level systems across remote diagnostics, secure access, event-driven data distribution, and authorization for Ericsson's enterprise networking products — several of which became foundational frameworks adopted across the wider microservice platform. Work spans the device data plane, the platform substrate, the multi-region deployment fleet, and more recently LLM-based operator tooling.
Speedtest Framework
Led a team to own end-to-end design and delivery of a remote diagnostics platform processing over 2 million speedtest runs per month to assess WAN performance across Ericsson devices. Drove expansion into a full troubleshooting suite — ping, traceroute, packet capture — with inbuilt automation enabling customers to perform preemptive network monitoring. Routed test traffic through AWS Global Accelerator so ~100 individually addressable measurement servers gained stable public reachability without changing an already-deployed probe fleet.
Remote Connect
Architected and delivered a secure remote access system supporting 10,000+ concurrent sessions across HTTP, SSH, RDP, and VNC with sub-5-second connection times, deployed as part of Ericsson's SASE solution. Drove design decisions on session brokering (Apache Guacamole) and automatic device discovery via DHCP, reaching machines on private customer networks through a device-originated reverse tunnel with no inbound firewall change.
Core Facts
Designed and implemented a distributed, event-driven framework that eliminated direct database dependency — streaming entity state via Kafka into per-service Redis caches, with atomic Lua-backed indexing, freshness guardrails, and replay-based cache rebuilds. Adopted across a large number of microservices on the platform.
Roles and Permissions Framework
Built a fine-grained, multi-tenant RBAC framework using Open Policy Agent (OPA) for declarative, AWS IAM-style policy enforcement, letting 20+ microservices define their own roles and enforce authorization consistently at the API, account, and individual-object level across three languages.
Explore more work at Ericsson6 workstreams +
AI-Based NetCloud Assistant (ANA)
Contributed to an LLM-powered agentic troubleshooting system using LangGraph and AWS Bedrock (Claude), featuring tool-use orchestration, RAG-based knowledge retrieval (OpenSearch), and a dual-pipeline Rasa NLU chatbot with custom LLM intent classifiers and real-time WebSocket streaming.
Remote Task Execution Framework
Owned the response-correlation and worker-decoupling path of an asynchronous RPC framework that lets any cloud workflow run commands on intermittently connected devices behind NAT — without the caller knowing which gateway process owns the device socket. Backend logic moved off the connection tier, so backend and schema changes stopped disturbing live device connections.
Common Data Platform
Worked on the streaming funnel service, Avro schema-contract enforcement, and the data-lake ingest path of a Kafka-backed platform that treats data as the first-class component. Normalized raw device telemetry into 20+ schema-managed topics and used Kafka Streams windowing to compute 15-minute and hourly rollups, with a lake path from raw events to partitioned analytics.
Regional Stack Sharding
Owned service infrastructure delivery into a fleet of whole-stack regional shards — each tenant assigned to a complete deployment with its own AWS account, VPC, cluster, and data stores. Wired dependencies, state, and capacity across production-class shards in the US, Europe, and Australia, lifting the monolithic database ceiling and meeting data-residency requirements.
SD-WAN Overlay Dataplane
Worked on a DPDK userspace forwarding path doing GRE encapsulation, DSCP-aware WAN bonding, packet duplication, reordering, and forward error correction across unreliable links. Traced a structural GRE MTU fragmentation problem to the tunnel interface and addressing model, then redesigned the per-tunnel receive and shared transmit split that removed it.
Single-VM Private Deployment
Contributed the device stream server, cloud-abstraction layer, and on-premise network design that let an eight-service, seven-datastore cloud product ship as one self-contained air-gapped VM appliance — installable in about fifteen minutes with no outbound internet access, from the same codebase as the cloud build.