Author Portfolio

Portfolio of Author

This page describes the work experience of Gorav Singal. Since the year I started working, job changes and startup experiences.

About the Author

Gorav Singal
Gorav Singal
I'm a software engineer by profession. Currently, I'm working for Adobe Systems, India. Its been more than 10 years in Adobe. I'm working since 2007. And, I still code.

My current designation is Computer Scientist. I just love this fancy designation name.
Below are my social addresses:

My Official Jobs

I started working from NEC HCL (now NEC), a japanese company. I got two offers when I started my career. I left higher paying job just because I did not want to work on Java. I chose NEC as I would be working on C/C++, my first love. Although, currently I'm working on Java and left C/C++ since long.

Adobe Systems

I joined Adobe, India in March 2010. There I worked on a variety of things starting from C++ to Action script. After around 2 years, I switched gears towards enterprise java implementations. I worked mostly on Java, web services, spring. I learned a lot here. I touched lot of technology stacks here.

NEC

I worked on a storage product in C++. I got some awesome development work. And I also got a chance to goto Poland. I worked there for around 2.5 years. I worked with some of talented mentors.


My Un-Official Jobs

These are my work that I started because of my interest in Startups. I hit the startup worm in late 2009. I started an educational venture which failed, but it left immense knowledge in me. Till now, I'm struggling to find a hit startup that can feed me in my retirement.

I do have a decent running idea, planndesign.com whose content is managed by my wife now.

I did never plan to work as freelancer. I always wanted to create products that can be helpful to people.

My Websites

These are the websites that I have longer plans with. I will run these for long.


My Work Brief

Intrusion Detection Monitor in Cloud (Year 2015)

A monitor to detect unintentional change in Adobe binaries

It was developed for alerting and notifying for any unintentional binary change in public cloud. I deplpoyed this solution in aws in three different geographies, for each origin server.

Features
  • Communication across intra corp network and public internet.
  • Provision to query for source of truth sitting in corp network
  • Messaging based communication across
  • Alerting based on SNS on Mobile app and Emails
  • Caught several issues where Akamai purge happens before binaries reached origin servers
Technologies and Skills
  • AWS EC2
  • SQS, SNS, SES
  • Java, JMS, AWS SDK
  • Android app for notification/alerting
  • Multi-geo deployments/workers
  • Cloud Architecture
  • Mysql RDS, Web service
  • Splunk, Veracode, Findbugs

Design of a Action and Analytic engine for reporting of Security issues (Year 2017)

A cloud solution for reporting Security issues and actionable items

This solution was architected and developed as a cloud based solution to detect securty issues and create actionable items for product teams.

Features
  • A dynamic rules based engine which runs in true serverless architecture
  • Ingestion service which feeds data to Elastic Search in AWS via lambda functions
  • True micro-services in form of lambda functions which forms a chain of action and analytics
  • Messaging based communication across corp network and aws public network
  • Created Jira tickets for product teams
  • Intelligently create Jira tickets for all possible combinations
  • Automation to report Jir tickets for Penetration testing activities.
  • Framework to include any security tool so that its ingestion and reporting will be done easily.
Technologies and Skills
  • Cloud architecture, Serverless architecture
  • AWS Lambda functions, S3, Cloudwatch
  • Elastic Search, MongoDB, Redis, Backbone JS
  • Node.js, Docker, Splunk, Consul for Service discovery
  • Jira automation via Rest api

Reporting of 3rd party library vulnerabilities - Security project (Year 2018)

A tool to report 3rd party library vulnerabilities

One of top security issue that also exist in OWASP Top 10, "Using Components with Known Vulnerabilities". This tool solves this issue. This is a tool provides web service and a web UI, reports list of security vulnerabailities in user's project.

Features
  • Report vulnerbailities
  • Plugins for users which they can embed in their build system automation
  • Instant reporting of vulnerabilities
  • Syncing security related from various sources like NVD, NPM, other 3rd party vendors
Technologies and Skills
  • Node.js, MongoDB, Elastic Search
  • Docker, Micro services
  • Facebook thrift for RPC among micro services
  • Redis, RabbitMQ
  • Splunk, Grafana

Hubble - A compliance tool in python (Year 2020)

An open source compliance tool - Hubble

This compliance tool automates the security standard that must exists on a host. There is an organization CIS which has defined a set of security standards for each kind of host system.

Features
  • Compliance score status
  • Automation based on salt libraries
  • Gather data from a host system and report it
  • File integrity checks
Technologies and Skills
  • Python
  • Salt modules, grains as library
  • OSQuery
  • Yaml files, Splunk

Automation pipeline to release or deploy distributable binaries/executables to CDN (Year 2015)

Automation pipeline for deploying distributable bits to CDN
Features
  • Standalone workers for pushing/updating/deleting binaries to origin servers
  • Akamai Purge for new binaries pull
  • Alert for an unwanted modificatio on file system
  • Secure system for users to push/update/delete binaries
Technologies and Skills
  • Java
  • Web service, Rest APIs
  • Akamai CDN, Akamai APIs
  • JBoss, Oracle, Hibernate

Development of common libraries for the team (Year 2015)

Collection of reusable libraries and components
Libraries for
  • Managing secrets/credentials from various sources like Cyberark, Vault, Local file read
  • Generic rest client with 2-way SSL configuration
  • Core set of code for multiple usages, Email lib
  • Collect various statistics like performance, memory
  • Monitoring tools like remote stats and dumps
  • JMS/SQS listeners and producers
  • SSL certificate creation utilities
  • File tranfer wrapper over ftp/sftp/ftps/scp
  • Wrapper libraries over Spring/Spring security
Technologies and Skills
  • Design and development of libraries
  • Java
  • Spring, Java beans, Spring security
  • Apache common libraries

Code Signing Automation (Year 2014)

Secure pipeline for Code Signing apps/binaries
Features
  • An excellent architecture for multiple type signing workers
  • Support for multiple signing types like Windows/Mac/Java etc
  • Certificates are placed in secure environment - HSM
  • Secure role based access for teams
Technologies and Skills
  • Architected the standalone workers
  • Java, Ruby, Splunk, Oracle
  • Concurrent signing/file transers
  • S3 chunk upload/download in parallel

Build repository metadata, and workflow triggers

A repository of build metadata and trigger points for various workflows
Features
  • Web service exposing more than 100 APIs
  • Soap and Rest API support
  • JMS messaging for various triggers
  • Role based access
  • Storing lot of metadata about builds for various products
Technologies and Skills
  • Java, JMS
  • Spring, Java beans, Spring security
  • Apache Active MQ, Apache commons
  • JBoss, Oracle, Hibernate

Unified Security Backlog for teams

Creating unified security backlog for various security related workflows
Features
  • Micro service based architecture
  • Webservice over Jira to create any kind of issue in any queue
  • Automation workflows for various types
Technologies and Skills
  • Java, Python
  • Spring, Spring security
  • Messaging, MongoDB
  • JBoss, Oracle, Hibernate

Ethical Hacking

Penetration testing and Ethical Hacking
Overview
  • Took part in penetration testing activities for some projects
  • Various security tools implementations
  • Won live competition in Ethical hacking competition
  • Using of securiity best practices in projects
  • Used various tools in this domain like Burp

Planndesign.com (Year 2017)

A web portal for Interior Designers and Architects
Features
  • Upload of Autocad drawings
  • User can buy subscription for premium drawings
  • Paypal for international users and Instamojo for Indian users
  • Various statistics across websites
  • Youtube video sync from planndesign.com channel
  • Blogging section
  • Amazon Affiliate. Country detection and country based redirection
Technologies and Skills
  • Php, Aws S3, Google cloud machines, Redis
  • AWS SES, SQS, SSL, Cloudflare CDN
  • Drupal, Drupal modules and theme development
  • Bootstrap, Web Design, TWIG templates
  • SEO, Digital Marketing, Google analytics, webmaster
  • Linux, Shell scripting for various automations
  • Image optimization techniques
  • Node.js, MongoDB, Youtube APIs for channel sync
  • Docker, Social Sharing services

GyanBlog.com (Year 2019)

A technical blog

It is a technical blog, which includes a variety of posts. Some of topics includes Coding best practices, programming languages features, Software architects, Micro services, Cloud architectures, Enterprise solutions, Maintainable architectures etc.

Features
  • Blogs, Articles
  • Affiliates
Technologies and Skills
  • AWS S3, Jekyll static website
  • Bootstrap, Theme design
  • SEO, Digital marketing, Sitemap, Webmaster, Google analytics
  • Image optimization scripts
  • Various automation scripts
  • Cloudflare CDN, SSL
  • Various website optimization techniques

LifeInText.com (Year 2019)

A web portal for people who wants to record their life memories
Features
  • Personal blog creation
  • Users can mention their date of story, it can be used as a timeline in their profile.
  • User can write stories as anonymous. Nobody can see who has written the story
  • User can have totally private stories too, that only they can see.
  • There are many plans for this, but this development is at rest for now.
Technologies and Skills
  • Php, Aws S3, Google cloud machines, Redis
  • Cloudflare CDN, SSL
  • Drupal, Drupal modules and theme development
  • Bootstrap
  • SEO, Digital Marketing, Google analytics, webmaster
  • Docker

KG se PG dot com (Year 2009)

It WAS an educational site. Name says: KG to PG. Although, its name is sold to someone else now.

We designed well defined categories for students. We created slideshare.net kind of website. It became hit and alexa ranking reached to 3L, but we had to close it as we could not monetise it.

Features
  • Multi uploader of any type of files (pdf, ppt, doc etc)
  • Conversion of different types of files to swf
  • Multi-level conversion of files to image files. Single image per page of a file
  • Used iNotify to detect file uploads, and run automation
  • A player to run slideshow of images
Technologies and Skills
  • Drupal as CMS, PHP, Javascript
  • SEO, Digital marketing, Sitemap, Webmaster, Google analytics
  • Image optimization scripts
  • Various automation scripts
  • Various website optimization techniques

Misc (Over the years)

Misc Details over the years
  • Design and development of various frameworks
  • Revamping existing projects for better optimization and maintainability
  • Dashboards in Splunk and grafana
  • Unit test cases for various part of code
  • Integrtion with various security automation tools
  • Team Leading for various projects
  • Penetration testing
  • Eclipse plugin development, Npm module development
  • Presented a research POC/paper about Malware detection and security vulnerabilities in San fransisco Adobe Tech Summit
  • Web Scraping iTunes for various analytic data and reviews.