Kiell Tampubolon

Automated Phishing Triage & Email Forensics Engine

Enterprise email security operations & incident response

• Reported emails used to mean an analyst opening the raw source and manually reading SPF/DKIM/DMARC verdicts for every ticket in the queue, a repetitive first pass that ate analyst time without making triage any more consistent.
• Automated extraction and parsing of raw .eml/.msg artifacts for phishing investigations.
• Header validation checks for SPF, DKIM, and DMARC alignment to surface spoofing vectors, flagging on alignment rather than raw pass/fail so convincing spoofs do not slip through.
• Webhook integration with KnowBe4 Phish Alarm Button (PAB) and PhishER for automated triage routing, so an analyst opens a ticket with header verdicts and indicators already attached instead of a blank email.
• AI-assisted triage workflow built with Microsoft Copilot Studio, Power Automate, and custom Python microservices; the model surfaces a recommendation and reasoning for ambiguous cases, a human still signs off on the close/escalate call.

Outcome — Published outcome: triage time for a reported email dropped from minutes to under thirty seconds per ticket, with a consistent verdict format across analysts.

Entra ID (Azure AD) Identity & Access Audit Engine

Enterprise identity security & AI administration

• Built to catch identity drift, not one bad config: an offboarded account that stays enabled for weeks because reconciling three separate systems is nobody’s single job.
• Automated cross-referencing of active vs. inactive Entra ID accounts against onboarding and offboarding tickets.
• Some of the usual PowerShell cmdlets for role auditing were unavailable in the environment (licensing tier and admin-restricted execution policy), which ruled out the standard scripted approach.
• Verified privilege boundaries for AI Administrator and Security Administrator roles directly through Microsoft Graph API calls and the Entra admin center’s role assignment views, cross-checked manually where API access was itself scoped down.
• Automated drift detection for stale accounts and policy violations, with standing (not one-time) compliance reporting.

Outcome — Working around restricted cmdlets forced a more API-first design, one that does not depend on a specific module version or an admin-granted cmdlet that could be revoked later.

Tier-1 OSS Agentic Auditing & Responsible Offboarding

Open-source systems engineering & AI-SDLC research

• Static and dynamic analysis across 25+ Tier-1 infrastructure repos, including vLLM, Qdrant, Ray, Temporal, OpenTelemetry, Dify, Meilisearch, DataFusion, and LiteLLM.
• Surfaced issues including atomic memory-budget overflows in Rust vector databases, circuit-breaker race conditions in Ray Serve, and missing OTLP HTTP retry handling.
• Chose to close 25 automated PRs rather than ship them: a patch that resolves a symptom in a local repro can still violate invariants only visible to someone who has lived in that codebase’s history.
• Held to explicit DCO (Developer Certificate of Origin) and CLA compliance on anything that reached a sign-off decision, to protect maintainer bandwidth over raw PR volume.

Outcome — The standard applied throughout: if I would not want to review a PR as the maintainer, I should not be opening it as the contributor.

Blue Team SOC Lab & Mentoring Framework

Training design · security mentoring

• Hands-on mentoring modules built around open-source Blue Team stacks (CyberBlueSOC).
• Interactive 60-90 minute detection and incident-response labs for SOC analysts.

Enterprise Wi-Fi Security & Threat Awareness Campaign

Awareness communications · corporate InfoSec

• Company-wide advisories on evil twin access points, captive portal risks, and public Wi-Fi hygiene.
• Standardized helpdesk knowledge-base documentation for user-facing security reporting.