Bipin Raj C

EXPERIENCE

Where I've built, researched, and shipped.

REC 01SEP 2026 — PRESENT

Hewlett Packard Enterprise

SYSTEMS SOFTWARE ENGINEER · HIGH PERFORMANCE COMPUTING (HPC) — BANGALORE, INDIA · FULL TIME

Working on the infrastructure behind some of the world's largest Supercomputers and HPC Systems.

I work in the High Performance Computing domain at HPE, on NGSM which is the system-management platform behind El Capitan, Frontier, and Aurora, some of the world's fastest supercomputers. My work spans Slingshot interconnect monitoring, Ceph-based exascale storage and security integrations with NGSM. The broader monitoring platform I contribute to is deployed across major supercomputing environments including Frontier, Aurora, CINES, and Aramco.

KEY CONTRIBUTIONS

  • Contributing to the broader HPE HPC monitoring ecosystem that supports deployments at Frontier, Aurora, CINES, and Aramco — cluster health, compute and non-compute nodes, cooling and power devices, workload managers (SLURM · PBS), and Slingshot interconnect telemetry.
  • Built a Python CLI framework around the Slingshot simulator, my primary individual contribution. One command runs HPCM read-only queries, fingerprints the system (compute nodes, vCPU, RAM, network configs, OS info), and auto-generates the network configuration YAML. No hand-filling.
  • Deploys simulated switches as Docker containers running Java/Xenon services that mock real hardware, arranged in a Dragonfly topology (32 switches per fully-connected group), multiple groups interconnected, up to ~2,500 switches. Each switch needs just 2 vCPUs and 2GB RAM, so the environment runs on any system with adequate resources.
  • Emits realistic Slingshot telemetry into Kafka topics, stress-testing the monitoring data pipelines (OpenSearch Alerting, Grafana Alerting) at scale without physical hardware.
  • Automates the full lifecycle of the simulation environment. Starts the FMN on the admin node, pushes its public key to compute nodes, registers simulated nodes as HPCM nodes, and enables telemetry - a complete mock of real hardware. Validated against Frontier-scale systems; slated to become an internal HPE tool across teams and business units.
  • working with the Ceph team, focusing on exascale distributed storage. Built Ceph integrations with multiple downstream security services to strengthen security capabilities within NGSM, and am expanding into Ceph monitoring and observability for large-scale HPC environments.

TECHNICAL SIGNALS

EXASCALE · SLINGSHOT · KAFKA · VICTORIA METRICS · GRAFANA · OPENSEARCH · CEPH · DOCKER · SECURITY

REC 02JAN 2026 — MAY 2026

VYUHA · Security Research

OFFENSIVE SECURITY RESEARCH — AFFILIATION · THWS, GERMANY

Led the offensive-security research track for an adaptive EDR evaluation framework.

Led the offensive-security research track for VYUHA, an adaptive EDR evaluation framework implemented in C++. The goal was to study the newest attack techniques used to evade modern endpoint defenses — implementing proof-of-concepts from recent security research and integrating them into a unified framework so we could systematically test where EDRs see and where they don't, and ultimately strengthen the defense. VYUHA combines four cross-layer attack primitives with a Deep Q-Network strategy selector that adapts technique selection to each product's observed responses.

PATENT · ACCEPTED IN INDIA

GITHUB · VYUHA ↗

KEY CONTRIBUTIONS

  • Built a BYOVD engine using CVE-2023-52271 in a legitimately signed kernel driver where the driver is already trusted by the OS, so operations run from kernel context, below the visibility of user-mode EDR hooks. Used to terminate EDR processes and study how kernel-level trust gets abused.
  • Built EDR-Freeze, exploiting a Windows Error Reporting race condition to suspend EDR threads through the signed system binary WerFault - no unsigned code, no injection, nothing for file-based detection to flag.
  • Built a Crystal Palace reflective loader with six evasion layers for in-memory payload execution which is mapped entirely in memory, never touching disk, defeating file-based scanning; KaplaStrike-produced PIC blobs add layers that resist static analysis and memory inspection.
  • Built a SysWhispers4 direct syscall engine with six SSN resolution strategies (FreshyCalls) that bypasses user-mode API hooks by invoking NT syscalls directly, so EDRs that hook Nt* functions in user mode never observe the call. This proved the weakest defensive layer across all tested products with 27% mean detection rate.
  • Studied low-level Windows internals spanning process execution, memory operations (NtAllocateVirtualMemory, NtProtectVirtualMemory), thread suspension, and how endpoint telemetry is generated and correlated at the kernel/user boundary.
  • Built a DQN strategy selector that adapts technique selection to each product's observed responses — SHAP explainability identifies which system properties drive technique selection, K-means clustering characterizes EDR defensive postures, transfer learning reuses policies across products. Evaluated against Microsoft Defender, SentinelOne, OpenEDR, Huntress, and Trend Micro Apex One across 60 attack instances.

TECHNICAL SIGNALS

WINDOWS INTERNALS · C++ · EDR · SYSCALLS · BYOVD · REFLECTIVE LOADING · EDR FREEZE · DQN · TRANSFER LEARNING

REC 03SEP 2025 — PRESENT

Namma Pothole

CO-FOUNDER / BUILDER — BANGALORE, INDIA

Civic-tech platform turning citizen reports into real road repairs in Bangalore.

Co-founded Namma Pothole, a civic-tech platform for identifying and resolving potholes and road-infrastructure problems. ~1,500 citizen reports filed, working with GBA to get reported potholes resolved on the ground. Fully cloud-native on Azure — Container Apps for backend, frontend, and Redis; a FastAPI backend; MongoDB for report schemas; Supabase S3 for pothole images; and a WABA WhatsApp bot for intake. GeoJSON calculations surface the nearest reported pothole to each citizen, with client-side distance computation.

AI VALIDATION

Built a two-stage AI validation pipeline — a CLIP ViT-B/32 model filters non-road imagery, then a fine-tuned EfficientNet-V2-S classifier detects potholes. Retraining improved accuracy from 88.89% to 90.74% and pothole recall from 89.66% to 96.55%.

SOFTWARE → CITIZEN REPORTS → COORDINATION → PHYSICAL-WORLD OUTCOMES

NAMMA POTHOLE ↗

TECHNICAL SIGNALS

AZURE · FASTAPI · REDIS · MONGODB · WHATSAPP BOT · GEOJSON · CLIP · EFFICIENTNET

REC 04JUN 2025 — DEC 2025

IIT Bombay TrustLab

TEACHING ASSISTANT · CRYPTOGRAPHY

Built and maintained containerized cryptography labs for IIT Bombay's TrustLab.

Designed and containerized hands-on cryptography labs using Docker, integrated into IIT Bombay's cLabs platform so students could spin up isolated, reproducible environments. Structured exercises for reliable execution, debugged lab workflows, fixed autograder edge cases, and stress-tested solutions to keep everything stable in production. Supported a diverse cohort of students and working IT professionals aged roughly 18–45 with technical guidance, hand-holding and review across multiple lab sessions.

TECHNICAL SIGNALS

DOCKER · CLABS · CRYPTOGRAPHY · LINUX · AUTOMATION

REC 05FEB 2025 — FEB 2026

HPE Internship

SECURITY / SYSTEMS ENGINEERING INTERN

Built an enterprise-grade security compliance framework for HPC systems.

Designed an end-to-end security compliance framework for HPC systems — an enterprise TUI for OpenSCAP compliance scanning, remediation, and rollback across Linux nodes.

GITHUB · RULEGUARD ↗

KEY CONTRIBUTIONS

  • Built an enterprise TUI for OpenSCAP compliance scanning, remediation, and rollback across Linux nodes.
  • SSH into nodes within an HPC environment, running detailed compliance scans across multiple profiles (CIS, NIST, other baselines), generating compliance scores, and explaining why systems are non-compliant.
  • Per-issue remediation guidance with remote remediation over SSH; system state tracked with version history in PostgreSQL, with rollback to previous states if remediation caused instability.
  • HTML, PDF, and XML reporting for internal audits and compliance verification.
  • Integrated Groq LLM to automate alert-to-remediation conversion and accelerate incident response.

TECHNICAL SIGNALS

GO · POSTGRESQL · WAZUH · OPENSCAP · LYNIS · GROQ LLM · SSH · LINUX