We interviewed Al Chen for year's AI Engineer NYC event. Al is a Software Engineering Leader at Cisco, where he leads the customer engineering team for Splunk Agent Observability (formerly Galileo). He specializes in production AI infrastructure, enterprise deployments, and agent engineering.
We talked about what it really takes to deploy AI agents inside major banks, from navigating security reviews and compliance requirements to preventing data leaks and designing agents that fail gracefully.
Here's our conversation.
Tell us about your talk.
The talk is a bit of war stories: our experiences deploying our platform inside various banks, how we get through the different compliance, security, and legal gates, and some of the potential solutions on the path forward. That's the main gist, and I'll walk through a few deep-dive examples.
How did you get into this work?
My path into AI was kind of circuitous. Like many people out there, I wasn't doing this even three years ago. I come from the world of spreadsheets and productivity software. I got the AI bug in 2023, early 2024, and I was super skeptical at first. I saw ChatGPT and thought, this is great for small use cases. Then I dug in some more and got really into the weeds with LangChain and different AI frameworks. About a year ago I had the opportunity to join a small startup, Galileo, which was acquired by Cisco. We're deploying our software within the largest banks and financial institutions in the world, and that's how I ended up dealing with CVEs on an everyday basis.
You've taken agent tooling into five Fortune 100 banks. What breaks first when a stack built for SaaS hits a tier 1 bank security review?
The first thing that breaks, and I'm going to talk about this at the conference, is dealing with CVEs: Common Vulnerabilities and Exposures. It's probably the number one thing all of our banks deal with. Before we even touch one piece of hardware or software, getting through that gate is the biggest hurdle. Until you have a really buttoned-down process for remediating vulnerabilities in your software, it's a showstopper for getting anything through the front door of a bank.
My team is on the frontlines of dealing with these day in, day out. It's a full-time job. Really, it's a full team's job. The problem is each bank has its own unique process, its own policies, and its own scanning software to determine what counts as an exploit or a vulnerability.
My job is to figure out how to systematize this, because we don't want to deploy bespoke solutions for every single customer. How do you do it all as one cohesive process? That's definitely been a challenge, and I'm curious to hear how others are doing it. Even at a big company like Cisco, we're probably still figuring out how to deal with different customers.
How do you split your time day to day between execution, strategy, learning, and problem solving?
It's the typical startup phrase: you're building the plane while you're flying it. I didn't know anything about CVEs or Kubernetes clusters before this role. I'm using AI to learn about these things, but until I really grasp the concepts, I still have to do some of my own self-teaching.
Top comments (0)