1. Email Threat Protection Platform
Overview
Architected and implemented enterprise-grade threat detection services for an email security platform (MTA) safeguarding thousands of enterprise organizations. Engineered an extensible adapter framework decoupling proprietary threat-scanning engines from downstream messaging queues, enabling seamless onboarding of advanced URL inspection models, malware sandboxing, and SPF/DKIM/DMARC alignment checks. Leveraged AWS SQS for resilient async queueing between engines, AWS SNS for real-time threat feed updates, and AWS Lambda for serverless threat intelligence lookups without blocking line-speed message processing. Stored high-resolution verdict metadata in AWS RDS with Celery and Redis worker fleets, providing unified administrative audit APIs, quarantine workflows, and DLP policy controls across millions of processed emails.
Challenge
The email-security product (an enterprise Message Transfer Agent / MTA) needed to detect phishing, domain spoofing, Business Email Compromise (BEC), and zero-day malware attachments using several independent threat-scanning engines and external intelligence feeds — while keeping the scanning framework maintainable as new engines and feed formats were added over time, and giving administrators enough visibility to search, tag, and act on processed messages.
Approach
- Designed an adapter-based plugin layer to evaluate SPF, DKIM, and DMARC alignment and route suspicious payloads to sandbox environments.
- Leveraged AWS SQS for resilient, asynchronous message queuing between threat-scanning engines, and AWS SNS for real-time alerting on critical threat feed updates.
- Utilized AWS Lambda for serverless, event-driven threat intelligence lookups without blocking line-speed message processing, storing verdict metadata in highly available AWS RDS instances.
- Built administrative APIs and audit queries backed by AWS RDS to give operations visibility into engine verdicts and message-level threat metadata.
Outcome
Allowed the security product to ingest new threat feeds and scanning engines without core pipeline rewrites, reducing new-engine onboarding time and giving enterprise administrators verifiable audit visibility into quarantine workflows, Data Loss Prevention (DLP) violations, and threat verdicts.