I build the platformother engineers ship on.

ESC Partners / HometownHUB · contract

• Staff Software Engineer, Platform & Product · Sep 2025 - Present
• Senior Full-Stack Engineer (Cloud) · May 2023 - Aug 2025

Most senior hands-on engineer on a small product team: set the standards the fleet adopts, own the team's AWS access as Terraform.

• Primary author of both generations of the fleet's core API and the auth and Oracle CCS patterns they share - 58% of v1, serving six of the seven launched tenants; 76% of v2, serving the seventh since June 2026.
• Primary author (93%) of the internal developer platform: a Terraform control-plane (9 stacks, ~60 AWS resource types) with a Fastify/React dashboard, onto which the fleet's provisioning is migrating tenant by tenant.
• Authored 17 architecture decision records (13 accepted); turned standards into gates - pre-push and pipeline verify checks, a lint rule instead of trusting review - and approved 135 PRs from teammates in 2026.
• Shipped the fix for an SSN identity-verification gap enabling account takeover - wrong-person matches on ~2.4% of one tenant's accounts - as attempt lockout plus ZIP disambiguation, flag-gated for per-tenant rollout.
• Built a billing-authoritative duplicate-login reconciler, dry-run by default, with a daily read-only prod sweep on Fargate in Terraform; it fails closed on a stale login-usage feed, found frozen for about 2 months.
• Remediated pentest findings in severity-labelled batches across 6 external test rounds - 60 findings triaged, false positives refuted - from IDOR and unauthenticated endpoints to URL-borne tokens and missing rate limits.

Nmblr · contract

• Senior Full-Stack Engineer

• One of 3 core engineers on an ISO 27001-certified biopharma strategy SaaS in private beta with enterprise pharma clients.
• Originated two subsystems from scratch: a schema-driven strategy clone engine and the Edge archive/restore isolation system.
• Built the in-house observability layer - an Apollo plugin emits one structured event per GraphQL operation to CloudWatch, classed as fault or noise, with staging and prod dashboards - then removed New Relic.
• Serialized rating upserts behind a Postgres advisory lock, killed a duplicate-groups race in a sync resolver, blocked re-entrant AI generation calls, and added double-press guards plus stale-poll reconciliation.
• Built per-strategy, per-user response controls for the AI assistant that only an internal strategy lead can set (clamped on read, refused on write otherwise), plus help-centre retrieval.