{ "$schema": "https://raw.githubusercontent.com/jsonresume/resume-schema/v1.0.0/schema.json", "basics": { "name": "Noy Oliel", "label": "AI Engineer", "email": "oliel.noy@gmail.com", "url": "https://profile.nyo.solutions", "summary": "Engineer with 10+ years in software, the last four on a cybersecurity SaaS. I build LLM features end to end, from agent backend to chat UI, and run them in production.", "location": { "countryCode": "IL" }, "profiles": [ { "network": "LinkedIn", "username": "noy-oliel", "url": "https://linkedin.com/in/noy-oliel" } ] }, "work": [ { "name": "Pentera (acquired DevOcean)", "position": "Senior Fullstack Developer", "startDate": "2025-10", "summary": "Created and lead the product’s AI assistant and the MCP server behind it.", "highlights": [ "AI assistant used by 200 customers: a multi-tenant, streaming agent on Claude through AWS Bedrock (Strands, FastAPI on Lambda, AG-UI events), taken from first commit to two AWS regions.", "MCP server with 72 typed, permission-scoped tools for the in-product agent and for outside clients (Claude, ChatGPT, Cursor, VS Code).", "OAuth for remote MCP: an RFC 9728 metadata service plus a per-region token checker that applies each user’s real permissions on every tool call.", "LLM cost and abuse controls: per-user and per-company rate limits, daily token and spending budgets, a concurrent-run cap and firewall throttling, tunable without a redeploy.", "Reliable streaming on serverless: deadline budgets, a guaranteed end-of-stream signal and bounded UI state machines; wrote the runtime decision record and the postmortems.", "Safety: content guardrails with a test harness, context redaction, per-company switches, and approval cards so the agent proposes and a person confirms." ] }, { "name": "DevOcean", "position": "Senior Frontend Developer & AI Cloud Engineer", "startDate": "2025-01", "endDate": "2025-10", "summary": "Owned the frontend platform and started the company’s move into AI.", "highlights": [ "Built the company’s first AI chat as a hackathon prototype; it became the production AI assistant.", "Owned frontend architecture, code quality and an automated release pipeline (semantic versions on every merge).", "Moved into full-stack work on the Python and AWS serverless backend, owning features end to end." ] }, { "name": "DevOcean", "position": "Leading Senior Frontend Developer", "startDate": "2022-10", "endDate": "2025-01", "summary": "Led frontend architecture for a security product’s web app.", "highlights": [ "Replaced a commercial graph library (about $50K a year) with an in-house engine on D3 and SVG: force-directed, nested-group and tree layouts.", "Redesigned filtering across the whole app around one URL-based filter language with a formal grammar.", "Built schema-driven forms for automations and ticketing integrations (Jira, Azure DevOps, Linear).", "Upgraded React 17 to 18 and moved the build to Vite." ] }, { "name": "Digital.ai", "position": "Frontend Tech Lead", "startDate": "2019-04", "endDate": "2022-03", "summary": "Tech lead for 4 full-stack teams across 13 frontend projects; managed 6 developers.", "highlights": [ "Migrated AngularJS 1.x to Angular 9 and removed 200K+ lines of duplicated code.", "Raised the main products to about 90% type coverage and built a shared UI library on one design system." ] } ], "projects": [ { "name": "AI assistant for a security SaaS", "description": "I started the product’s AI assistant as a hackathon prototype and built it into a production feature used by 200 customers. Security teams ask questions about their own data in plain language; the assistant answers with live streamed replies and can act inside the app, while a person stays in control of every change.", "highlights": [ "Agent backend: Python on AWS Lambda, Claude through AWS Bedrock with the Strands agent framework, streamed to the browser as AG-UI events.", "Reaches product data through the MCP server, loading only the tools it needs via BM25 keyword search.", "Acting safely: it can navigate, set filters and prepare tickets, policies and automations, and every change appears as an approval card a person confirms.", "Cost and abuse controls: per-user and per-company rate limits, daily token and spending budgets and a concurrent-run cap, tuned from the back office without a redeploy.", "Reliability on serverless: deadlines set below the platform’s kill limit, a guaranteed finished signal on every path, and UI state machines with bounded waits; the runtime choice is recorded in a decision record.", "Safety and observability: content guardrails with a test harness, redaction of page context from stored history, a per-company switch, and per-call token and cost tracing." ], "keywords": [ "Python", "Strands", "Bedrock", "Lambda", "AG-UI", "React", "CopilotKit" ] }, { "name": "MCP server and OAuth for outside AI clients", "description": "I built the product’s Model Context Protocol server, the standard plug-in interface that lets AI agents call outside tools. It exposes the product’s data and actions as 72 typed tools: the product’s own assistant uses it, and so can customers’ AI apps such as Claude, ChatGPT, Cursor and VS Code.", "highlights": [ "Permissions on every call: each tool runs with the signed-in user’s real role and application access; write tools are labelled destructive and risky tools are off.", "Standard OAuth sign-in for outside clients: a small service publishes the protected-resource metadata document (RFC 9728) and a token checker in each region validates tokens.", "Public endpoint protection: a web application firewall with a per-user rate limit and a block list, plus a per-company on/off switch.", "Usability for models: tool annotations (read-only, destructive, open-world), templated workflow guides and on-demand tool discovery, so the model sees only relevant tools.", "A plain REST endpoint exposes the same tools to systems that do not speak MCP." ], "keywords": [ "Python", "MCP", "OAuth 2 / RFC 9728", "JWT", "AWS WAF", "CDK" ] }, { "name": "SARA: agentic software factory", "description": "SARA is my own initiative, self-funded so far: a software factory that makes software-development work agentic and automated. It turns a plain-English feature request or bug report into a reviewed, tested pull request. I have presented it to the CEO, the CTO and team leads, and other teams asked to use it. It is not shipped; a live demo is available.", "highlights": [ "Request to pull request: agents run a gated pipeline (investigate, requirements, design, code, review, test); a stage passes only when its typed output meets its requirements, and failures send work back.", "Grounded in the code: it builds a product-feature catalog and a code graph from a company’s repositories, so agents work from what the code actually does.", "Model routing: each stage runs on a model tier (bulk, balanced, quality) across several providers, including local and open-weight models, with usage metering and spend caps.", "One hard problem: open-weight models stopped after a single tool call, so I rebuilt their execution loop.", "Built for many companies: workspace data is isolated across Postgres row-level security, the graph database and file storage, with role-based access and a human-approved learning library." ], "keywords": [ "Next.js", "TypeScript", "Python", "Postgres RLS", "pgvector", "Memgraph" ] }, { "name": "AI development toolkit for the team", "description": "I built the shared workspace the development team uses to work with AI coding agents (Claude Code, with basic Codex support), so every developer starts with the same codebase knowledge, workflows and safety rails. The whole team adopted it at first; it later branched into environment-specific setups, and about four developers still use the original.", "highlights": [ "Knowledge as skills: a catalog of skills per repository, technology, process and operation, which agents load on demand instead of carrying everything in their prompt.", "skill-discovery (BM25), web-crawl (documentation RAG) and persistent memory on an extended open-source server.", "A conductor workflow: a planning session delegates to role agents (investigator, architect, developer, reviewers, tester) in a fixed order with review gates.", "Hooks recall memories at session start, capture the user’s corrections, and block destructive commands and pushes to protected branches.", "Per-agent disposable AWS environments built on floci, an open-source emulator." ], "keywords": [ "Claude Code", "MCP", "BM25", "RAG", "Docker" ] }, { "name": "In-house graph engine", "description": "The product’s asset relationship graph ran on a commercial graph library licensed at about $50K a year. I compared three alternatives, built an in-house engine on low-level D3 primitives that draws straight to SVG, and removed the licensed library once every graph view was covered. It ran in production until mid-2025, and part of its layout code is still in use.", "highlights": [ "Layouts: a force-directed view that nests assets inside their groups with collision forces so nodes never overlap, a tree view and a general network view.", "Interaction by hand: centred initial zoom with scale limits, panning, dragging, selection, arrowheads and link colours by connection type.", "Product features on top: root-cause emphasis, data-asset highlighting, owned-by relations and loading states." ], "keywords": [ "React", "D3 v7", "SVG" ] } ], "skills": [ { "name": "LLM agents", "keywords": [ "Agent development (Strands, Bedrock)", "Tool calling and human-in-the-loop", "Streaming (SSE, AG-UI)", "Multi-agent pipelines", "Claude Agent SDK", "Open-weight models" ] }, { "name": "MCP and tooling", "keywords": [ "MCP servers (HTTP, SSE, stdio)", "OAuth for remote MCP (RFC 9728)", "Tool and skill retrieval (BM25)", "Claude Code agents, skills, hooks" ] }, { "name": "AI platform", "keywords": [ "Token and cost metering, budgets", "LLM observability (OpenTelemetry, Datadog)", "Multi-tenant isolation", "RAG and embeddings", "Formal evals" ] }, { "name": "Engineering", "keywords": [ "Python, FastAPI", "TypeScript, React, Next.js", "AWS and CDK, multi-region", "Postgres, DynamoDB, MongoDB" ] } ], "education": [ { "institution": "Ben-Gurion University of the Negev", "area": "Computer Science", "studyType": "B.Sc.", "startDate": "2010", "endDate": "2015" } ], "languages": [ { "language": "Hebrew", "fluency": "Native" }, { "language": "English", "fluency": "Native or bilingual" } ] }