Shanto Mathew

Designed and built a multi-agent SOC copilot using LangGraph that ingests Splunk ES notables and orchestrates specialized agents for triage, enrichment, correlation, and decisioning.

The system uses a RAG layer over MITRE ATT&CK, internal runbooks, and historical incidents (ChromaDB + FAISS) so agents can ground responses in real TTP context. MCP-style tool guardrails control actions across Microsoft 365 Defender, CrowdStrike, and ServiceNow, ensuring every action is policy-checked and auditable.

I implemented prompt engineering patterns, structured outputs, evaluation harnesses, and observability hooks to enable analysts to review and override agent decisions. The deployment reduced manual L1/L2 analyst intervention by 60% and cut mean time to investigate by 45% on high-volume notable categories. Built with Python 3, LangGraph, LangChain, OpenAI, ChromaDB, FAISS, Splunk SOAR, and FastAPI.

Built an agentic revenue-ops workbench that streams live buyer-intent signals from public sources via GLM-5.1 + web_search, scoring each account against ICP fit and brand-voice thresholds in real time.

I designed a signals dashboard tracking hiring, funding, expansion, exec-hire, and compliance triggers across global accounts, with approval queues, in-flight run telemetry (p95 22.4s), and live streaming refresh. I implemented multi-agent orchestration with degraded-mode fallbacks, connector health monitoring, and human-in-the-loop approvals before any outbound action. I delivered a production-grade UI with operator-friendly filters, regional segmentation, and audit-ready signal provenance for go-to-market teams.

Designed a forward-deployed cockpit for shipping ElevenAgents' voice AI from enterprise discovery into production.

I built launch-room, architecture, simulation, safety, stakeholder, and productize modules covering API integrations, evaluation results, executive updates, and reusable pilot kits. I also implemented launch-gate checks, synthetic-data evaluations, and hold-launch controls to capture risk before go-live, plus repeatable customer feedback loops for an enterprise voice rollout. I shipped a polished operator UI that mirrors how a forward-deployed engineer owns architecture, runs go-live reviews, and turns one customer launch into a productized motion across accounts.

Built a live voice-controlled clinic front desk powered by xAI Grok, where a synthetic receptionist handles appointment scheduling, availability checks, plan verification, and office FAQs over real-time audio.

I implemented streaming caller mic and receptionist audio with live transcript, caller intake context, open-slot inventory, and console navigation by voice. I enforced no-medical-advice safety boundaries, PHI-free logging, and an automatic 5-minute call disconnect to satisfy compliance guardrails. I delivered Front Desk, Schedule, and Audit views, plus a synthetic demo mode, so prospects and operators can exercise the agent without exposing real patient data.

Designed Y22 Roleplay, a voice-driven AI sales training simulator where reps practice live calls against synthetic buyer personas powered by a Grok voice think-fast model.

I built 3 preset buyer archetypes (Skeptical Mid-Market CFO, Friendly-but-Firm VP Sales, Procurement Gatekeeper) with difficulty tiering, plus a custom buyer builder so managers can spin up any persona on demand. I implemented a six-tile behavior scorecard that fills in live during the call, a Prompt Lab for tuning persona prompts, and an end-of-call scorecard to coach reps. I streamed real-time voice with synthetic-data-only safety mode, making it safe to ship to enterprise sales organizations as a daily practice tool.

Built a 1-button SOC investigation agent with visible graph mechanics, powered by a LangGraph incident-investigation pipeline on a live GLM-5.1 back end.

The agent streams graph execution, checkpoint snapshots, tool calls, and human approval interrupts while it triages a freshly generated incident—covering enrichment, log analysis, ticketing, and remediation steps. Surfaced operator-grade telemetry: checkpoints, tool-call counts, token usage, and MTTR per run, plus parallel Send() fan-out and map-reduce back-edges to demonstrate real LangGraph patterns. I packaged the demo as a click-to-run experience so SOC managers can see how agentic AI compresses Tier-1 triage without giving up auditability or approval gates.