I build full-stack applications, backend/data platforms, automation systems, and applied AI tooling. My 7+ years across technology, fintech, law, and finance — plus earlier game development, web engineering, and programming instruction — bring security, risk, and regulatory depth to practical, observable, and explainable software.
A glance at who I am — scored the way I score the people I watch. No open findings.
Experience across software development, security, digital forensics, and internal audit, connecting data analysis with customer communication, practical education, and collaboration across business and technical teams.
Conduct internal audits across information security, privacy, IT, and AML, combining operational data analysis with evidence review and practical recommendations. Use SQL and Python to investigate behavioral patterns and design continuous monitoring scenarios; build AI-assisted workflows for audit preparation. Create guides and training materials for internal audit and compliance education, translating complex requirements into clear instructions. Collaborate with business and technical teams to understand root causes, agree on corrective actions, and communicate findings.
Handled client communication as a core responsibility in the evidence investigation and digital forensics team: interviewed clients, clarified needs, answered questions, and explained evidence requirements. Analyzed digital and documentary evidence, organized case findings, and worked with attorneys and case staff to resolve information gaps and coordinate follow-up. Built Python tools for voice tampering detection, web crawling, and speech-to-text transcription to support case analysis. Combined technical investigation with clear client guidance and structured reporting.
Worked in the security team and supported Bitfront service operations, combining fraud and abuse monitoring with customer communication. Used Salesforce extensively to request supporting documents, review customer evidence, and determine whether account restrictions were warranted. Analyzed transaction and user activity data, operated Chainalysis Reactor and KYT, and refined detection rules and account controls. Monitored Discord and Telegram communities, tracked user concerns, and collaborated with service, engineering, security, and operations teams to investigate issues and coordinate responses.
Developed interactive game content using JavaScript and Python, working with gameplay logic, event-driven interactions, debugging, and iterative feature refinement. In parallel, taught JavaScript application development and Python programming/data analysis as a freelance coding instructor, including SSAFY training, and created hands-on curriculum that translated implementation concepts into working exercises.
Maintained internal IT management systems at Korea's central bank. Performed data analysis for system performance optimization — the first step into financial technology that set the trajectory for everything since.
A cross-functional stack built from software development, data analysis, fraud/security operations, forensics, and audit — useful for both engineering-heavy and risk-heavy roles.
Production deployments, interactive full-stack services, applied-AI systems, public engineering repositories, research systems, and side builds. The common thread is turning ambiguous operational problems into working software, measurable controls, explainable decisions, reproducible technical artifacts, and deployable systems.
Portfolio and reference implementations with reproducible source and explicit limits. Data-driven demos use synthetic or openly available data, never employer data.
Full-stack evidence-review workspace with source-backed records, tenant and role boundaries, durable leased SQL jobs, version-checked human approval, and append-only audit history. Cloud Assurance extends the workflow with eight common control objectives, candidate framework mappings, AWS-shaped evidence checks, source fingerprints, and exportable review actions. Operations uses deterministic text/CSV/JSON extraction; the separate RAG Lab demonstrates TF-IDF retrieval, citation validation, and an optional OpenAI reasoner.
The public demo uses SQLite and fictional documents and personas. PostgreSQL row-level isolation and concurrency are verified separately in the integration suite. Cloud checks use synthetic inputs; framework links are candidate domain overlaps, not certification claims.
Explore usage by cohort and period, adjust hybrid-ranking weights, and inspect the score contributions behind each recommendation. Cold-start handling and time-split offline evaluation use the same TypeScript domain engine as the interactive browser workspace.
Runs on synthetic sessions without bank-account connections. Evaluation metrics validate this bounded dataset, not real-market performance.
Interactive blockchain-investigation console built on the existing Python/NetworkX tracing engine. Analysts can choose a synthetic seed wallet, switch inbound/outbound tracing, change hop depth, explore a live transaction graph, inspect address-level risk signals, follow exposure paths to synthetic high-risk services, and review the transaction evidence supporting each trace.
End-to-end full-stack event platform with a React/TypeScript operations console, FastAPI REST APIs, asynchronous event processing, user/event analytics, Dockerized local orchestration, observability, and CI. The repository includes the production-oriented Redis Streams + PostgreSQL architecture, while the public live demo uses a zero-cost ephemeral backend so recruiters can interact with the browser-to-API flow without paid infrastructure.
Reusable TypeScript/Node.js real-time systems prototype combining server-authoritative WebSocket state, ordered match phases, CSPRNG-based fairness randomization, layered settlement logic, a React + PixiJS Canvas/WebGL surface, rule-based strategy decisions, Redis reconnect sessions, PostgreSQL event history, and explainable integrity/collusion-risk signals.
Detects unusual access to sensitive data using behavioral baselines, transparent rules, and explainable risk scoring — a public-safe recreation of access-monitoring problems encountered in privacy and internal-control work.
Reproducible fraud-risk pipeline combining customer baselines, transaction-pattern rules, velocity checks, and explainable scoring on synthetic data. Every alert remains traceable to named signals rather than a black-box score.
Reproducible benchmark for search APIs measuring request success, retries, latency, payload size, result completeness, repeatability, overlap, and structured SERP coverage.
Redesigned rule-based monitoring into data-driven scenarios covering authority mismatch, anomalous transfer patterns, and channel-specific transaction anomalies. Coordinated across engineering, data, and compliance to ship risk-prioritized rollout.
Designed an AI agent that automates AML audit preparation — regulatory mapping, precedent search, and draft report generation — with three hard-coded security layers: prompt validation, human-in-the-loop review, and full audit logging.
Designed and operated an ML-based fraud detection system for NFT transactions while running Chainalysis Reactor and KYT daily. Managed black/white-list governance based on on-chain transaction pattern analysis.
Built an automated system in Python that analyzes voice recordings and detects tampering or editing artifacts for legal evidence verification. Integrated into firm's forensic workflow to accelerate case analysis.
Engineered crawlers for five Korean financial regulators (FSS, FSC, PIPC, KOFIU, KFB) under strict corporate security constraints. Solved SSL/TLS handshake issues and dynamic AJAX rendering to surface regulatory updates in real time.
Built interactive game content with JavaScript and Python, focusing on gameplay logic, event-driven interactions, debugging, and iterative feature changes. This development background now connects naturally with real-time architecture, fraud prevention, and platform security.
Started as an undergraduate capstone and continued after graduation as a freelance implementation for a real snack-service business. Used monthly user/product consumption data together with behavioral and product features to score and rank recommendations, refresh rankings as new data arrived, and support next-month assortment and inventory decisions.
Worked with Node.js backends, React and Vue.js frontends, and relational databases including PostgreSQL and MySQL across undergraduate, graduation, and applied projects. Experience included API/data flow, UI implementation, persistence, and debugging across the stack.
Taught programming through implementation-focused exercises and project work. The teaching experience strengthened code explanation, debugging communication, technical documentation, and the ability to break complex systems into teachable components.
Single-page bilingual portfolio with tab routing, dark/light themes, a command palette, responsive layouts, reveal interactions, and a public project catalog — maintained as code so the portfolio itself also serves as a lightweight engineering artifact.
Built a BTC address/transaction tracing pipeline. Clustering heuristics (common-input, change-address) and early mixer-detection rules became the foundation that the thesis work was layered on top of.
Ethereum-side counterpart — ERC-20 / ERC-721 flows pulled via Web3, graph-based visualization of counterparty relationships, and anomaly surfacing on unusual contract-interaction patterns.
Enriched on-chain addresses with OSINT signals (forum mentions, leak datasets, exchange labels) to link seemingly unrelated transactions into cohesive actor clusters. Fed directly into the thesis mixing-analysis workflow.
Pulled public posts across Twitter, Telegram, and Discord into a unified pipeline, extracted behavioral signals (language, timing, topic), and produced threat-actor profile scores — useful primitive for both AML and CTI workflows.
End-to-end pipeline that scrapes TTPs off each APT group's MITRE page, builds an ATT&CK Navigator layer JSON, draws the campaign timeline, and auto-renders a Markdown + PDF intel report via Jinja2 and Pandoc. Took APT38 through the full loop as the pilot case.
File-system behavior monitoring with entropy-based heuristics to catch encryption activity early. Prototype-stage system exploring the tradeoff between latency and false positive rate in host-level detection.
Reconstructed the FDS work I did at LINE into a public-shareable project. Virtual-asset transactions in, three behavior rules on top (repeated large-withdrawals, new-wallet burst, outlier frequency), a Sankey view of fund flows, and a Streamlit dashboard for hit-rate and high-risk share. Tried Isolation Forest / LOF too — rule-based still won on this data.
Selenium-based crawler that walks Discord's SPA (2FA handling, lazy-load scroll, class-name drift) to pull keyword-matched messages out of crypto channels, then runs them through a Hugging Face DistilBERT sentiment pass with matplotlib pies on top. Built on the side to make anomaly triage at LINE a little less manual.
Earliest "this is what I actually want to do" project. Applied data-mining techniques to equity tick data to flag patterns consistent with manipulation, and it's the seed from which everything AML-shaped grew later.
Built web/application projects during undergraduate and graduation work and gained hands-on experience with Node.js, React, Vue.js, PostgreSQL, and MySQL. These projects formed the full-stack foundation later reused in automation, data, and security tooling.
Small Python tool that turned recurring manual reporting tasks into a one-command job. Nothing fancy — but the kind of thing that buys back hours every week once it's running.
The source material underneath the work. Original research on blockchain privacy and financial crime, plus a running log of papers I keep coming back to.
Classified Bitcoin mixing techniques (CoinJoin variants, custodial mixers, chain-hopping patterns) and evaluated tracking heuristics against each class. Built the experimental pipeline on top of the BTC/ETH tracing systems from the research projects, and the conclusions shaped how I later approached on-chain AML at LINE NEXT and Toss Bank.
First formal research project — applied data-mining techniques to Korean equity tick data to identify patterns associated with spoofing and layering. The methodology (pattern extraction → threshold tuning → validation) is essentially the same shape of thinking I now use for AML scenario design.
Curated reading log. Topics orbit blockchain privacy, financial crime detection, digital forensics, and — more recently — AI security.