From Cloud Pipelines To Smart Buildings: Pooja Chandrashekar Murigappa Brings A Security Mindset To Building Automation

Every modern building quietly tells a story. Sensors log temperatures, controllers record alarms, and equipment leaves a trail of trends hour after hour. For decades that story stayed inside the building. Now it increasingly travels to cloud platforms and analytics tools, and facility operators face a harder question than whether the data is useful: whether it can be trusted and protected.

Pooja Chandrashekar Murigappa has spent her career close to both halves of that question. A software engineer with more than five years of experience in machine learning, cloud computing, and data engineering, she built machine-learning systems in the cloud at Amazon in Seattle. Today, at Trefz Engineering Inc. in Philadelphia, she works on the building automation systems that run commercial and university properties. Running through both chapters is a body of published research on a problem that now sits squarely between them: how to secure the connected systems that people depend on.

Her path offers a useful lens on a shift that building owners and engineers are only beginning to absorb. As automation networks connect to enterprise IT systems and cloud services, the skills needed to run a building are converging with the skills needed to defend a data center. Murigappa has worked on both sides of that line.

Learning What Makes Models Reliable

At Amazon, Murigappa worked on the part of machine learning that determines whether a model is actually useful: getting it into production reliably, again and again. She built end-to-end machine-learning and data pipelines on Amazon Web Services, automating the steps that carry a model from development to deployment. According to Murigappa, that work cut model deployment cycles by 40 percent. She also developed machine-learning and natural language processing tools in Python and PyTorch, and fine-tuned BERT- and GPT-based language models.

She built tools powered by large language models that reduced manual analysis and review, and she automated the monitoring and reporting that tells teams how their models are performing. The result was less manual work for the people relying on those systems and a clearer view of how the models behaved once deployed.

The experience left her with a conviction that she brings to every project: models cannot compensate for poor-quality input data. Incorrect mappings, missing readings, inconsistent timestamps, and poorly configured sensors quietly distort results, however sophisticated the model built on top of them. Engineers, in her view, must first establish that the collected information accurately represents what is happening in the real world. Only then does analysis deserve trust.

From Reliable Models to Secure Systems

Trust in data leads naturally to a second question: trust in the system that carries it. Murigappa’s research took that step. Her paper on machine-learning-based zero-trust intrusion identification for cloud systems is among the most cited on her Google Scholar profile. Zero trust is a security approach built on the premise that no user, device, or connection should be trusted automatically; every request must be verified. Her work examines how machine-learning models can help identify intrusions in that kind of environment.

That paper is one of eight in a body of published research that spans artificial intelligence, software engineering, cloud security, DevOps, and site reliability engineering. Other topics include AI applications across the software development lifecycle, loan-default prediction, CI/CD integration in DevOps workflows, automated defect prediction, cloud-native incident management, software application efficiency, and machine-learning-based software fault prediction.

Two of those papers, both published in IEEE Xplore in 2026, show how she applies machine learning to software quality. “Predicting Software Faults Using Machine Learning Models for Quality Improvement: An Empirical Study”, presented at the 2026 IEEE International Conference for Convergence in Computing Technology (I3CTCON), compares machine-learning models for identifying fault-prone code before release, so teams can focus quality-assurance effort where problems are most likely and fix them while they are still cheap to fix. “A Predictive Machine Learning Approach for Enhancing Software Testing Efficiency with Automated Defect Prediction”, presented at the 2026 World Conference on Computational Science and Technology (WcCST), builds on that idea with a model that automatically flags likely defects, helping testers direct their time to the parts of a system that need it most.

The thinking behind both studies, learning from past behavior to predict where a fault will appear next, is the same thinking she now brings to fault detection in building systems.

She also serves as a peer reviewer for IEEE conferences on artificial intelligence, computing, and communications, a role that asks researchers to judge the work of their peers.

Her interest in security is academic as well as practical. She is pursuing a second master’s degree in cybersecurity at Avila University, studying network security, cyber risk, secure systems, and resilience, and she sees that knowledge as increasingly relevant as AI, cloud computing, and physical automation become more interconnected.

“Connecting automation systems to cloud services and analytics platforms can create new opportunities, but it also makes asset visibility, access control, network protection, and system resilience increasingly important. Security measures must be designed around the operational requirements of the equipment they protect,” she explains.

Why Buildings Are the Next Frontier

Buildings have not always been a security concern. Automation systems often ran on isolated networks, managing heating, cooling, ventilation, and alarms with little exposure to the outside world. That is changing. When building automation networks communicate with enterprise IT systems, cloud services, or remote monitoring platforms, operators must consider unauthorized access, exposed devices, insecure connections, and weaknesses in older infrastructure.

Federal guidance reflects the shift. On September 21, 2026, the National Institute of Standards and Technology released the initial public draft of the fourth revision of its Guide to Operational Technology Security. The draft expands its introduction to cover building automation and control systems, alongside other sectors, and its public comment period runs through November 30, 2026.

The practical lesson is that securing a building is not the same as securing an office network. Because building automation controls physical operations, security measures must avoid unnecessary disruption to essential functions. Practical steps include maintaining an accurate inventory of connected devices, restricting access according to responsibilities, monitoring network activity, segmenting networks where appropriate, and evaluating the security implications of remote access.

Putting Both Disciplines to Work at Trefz Engineering

At Trefz Engineering Inc., Murigappa designs and supports building automation systems for commercial and university projects, working with Siemens controllers and industry-standard protocols such as BACnet and Modbus. She reviews trends, alarms, and equipment data to troubleshoot problems, spot abnormal behavior, and improve performance, and she uses historical control-system data to support analytics, fault detection, and AI-based performance improvements.

A recurring challenge is integrating older control systems with newer platforms. Commercial buildings and university facilities often contain equipment installed at different times, using different protocols and configurations, so modernization requires more than connecting a new analytics application to an existing network. Murigappa works closely with mechanical, electrical, and software teams during design, testing, and commissioning, and she emphasizes understanding how individual components behave within the wider system. An incorrect point mapping or communication issue can affect monitoring accuracy, while a poorly tested control sequence may produce unexpected equipment behavior.

She sees the data these systems already produce as the starting point for smarter operations. “Building automation systems generate valuable information through sensors, controllers, alarms, and historical trends. The challenge is to turn that information into reliable insights that help engineers identify abnormal behavior, understand recurring faults, and make better maintenance decisions,” Murigappa says.

This is where her earlier work carries over directly. A wrong point mapping can distort monitoring just as bad training data can distort a model, and an exposed connection can matter as much on a building network as in a cloud account. Few engineers in building automation bring published AI research and hands-on controls experience to the same job.

Looking Ahead

Predictive maintenance, energy optimization, and automated fault detection can deliver practical benefits, but their effectiveness depends on accurate data, compatible systems, careful testing, and appropriate cybersecurity safeguards. Delivering them will take collaboration among software developers, controls engineers, cybersecurity specialists, and facility operators, and organizations that treat AI, automation, and security as separate initiatives will struggle to realize them.

Murigappa holds a Master of Science in Computer Science from the University of Central Missouri and a Bachelor of Engineering in Computer Science from Visvesvaraya Technological University. For her, the move from cloud pipelines to building controls was less a change of field than a change of setting. In both, the work comes down to the same discipline: apply data-driven methods with respect for the equipment, the operating conditions, and the people who depend on them, and build security in from the start rather than adding it afterward.