Context
Avante Security operates IoT security devices in the field — hardware that watches physical assets. Through an 18-month project contract, our principal built the cloud side: the system that turns raw device telemetry into operational awareness.
The problem
Security telemetry is relentless and mostly boring, which is precisely what makes it dangerous: the interesting events hide inside the noise floor. Polling architectures fall over at fleet scale, and naive threshold alerts train operators to ignore alarms. The system needed to be event-driven end to end, and the detection needed to be learned, not hardcoded.
What we built
Devices publish into AWS IoT; Lambda functions process events; DynamoDB holds device state with single-digit-millisecond reads; EventBridge routes state changes to whoever needs them. No servers, no polling, no idle cost.
Detection runs on SageMaker using custom in-house models over the telemetry streams — anomalies trigger automated alerting. A RAG pipeline over OpenAI’s API parses security news, adding context a sensor feed alone can’t provide.
The entire stack is CloudFormation. A GitOps pipeline tests and provisions every change with zero-downtime releases — and because everything is code, disaster recovery is one click, not one weekend.
Key decisions
Event-driven over polling: at IoT fleet scale this is the difference between a system that scales linearly and one that melts. Custom models over vendor black boxes: a security firm must be able to explain why an alert fired.
Outcome
A serverless monitoring and threat-detection backbone with real-time state, learned anomaly detection, and infrastructure that rebuilds itself from code — the architecture pattern behind JES’s security-operations practice today.