I build control-plane and data-plane systems on AWS and GCP — Go, Scala and Java distributed services that process 50M+ transactions daily at sub-millisecond latency, alongside the control planes that provision,authorize, govern and observe them across 50+ tenants.

The thing I've spent this year on is Intent = Execution: what a system actually does should be continuously provable against what was specified. That means spec-driven development with BPMN process models and invariant conformance contracts, a CI/CD gate that blocks any deployment diverging from the approved spec, and a conformance engine that scores every runtime execution against its contract and records the evidence.

Twelve years, starting in C++ on retail terminals and mobile hardware.I care most about systems that stay fast, secure, and boring in production — the kind of infrastructure people trust without thinking about it. These days I also use LLMs as engineering infrastructure rather than a demo: Claude in a C++-to-Go translation and test-harness pipeline, GPT-4 extraction in production data paths.

• ☁️ Cloud Infrastructure — Multi-account, multi-cloud (AWS/GCP) environments codified with Terraform, AWS CDK, CloudFormation & GCP Deployment Manager
• ⚓ Kubernetes at Scale — EKS/GKE cluster administration, Helm-driven multi-environment deployments, mTLS service mesh security
• 🔁 CI/CD & GitOps — Automated pipelines (Jenkins, GitHub Actions) with deployment gates, health checks & rollback logic
• 📊 Observability — Full-stack instrumentation with OpenTelemetry, Prometheus, Grafana, Datadog & Splunk
• 🔐 Security & IAM — Zero-trust architectures: mTLS, OAuth2/OIDC, SSO, workload identity, KMS/HSM encryption, PCI-DSS & NIST compliance
• 🏗️ Distributed Systems — Event-driven microservices, BFF patterns, gRPC/REST/GraphQL/MQTT APIs at massive scale

Languages

Cloud & Infrastructure

CI/CD & Automation

Data & Messaging

Observability

APIs

• ☁️ Google Cloud Professional Cloud Architect
• ☁️ AWS Certified Solutions Architect – Associate
• 🧑‍💻 Programming in Golang Specialization (Coursera)
• 🤖 Generative AI Fundamentals (Databricks)

Systems built inside employers — no public repository. Public code is in the section below.

Architected a consumer decisioning platform as a control plane that defines intent and a data plane that executes it, with conformance enforced continuously across both so deployed behavior is provably equal to declared specification. Established Speckit (spec-driven development) as the control plane's source of truth — PRD, Spec.md, BPMN process models, and invariant conformance contracts — giving product, risk, and engineering one machine-readable definition of intent that the data plane consumes directly. An I=E gate check in the CI/CD pipeline blocks any deployment whose BPMN flows or invariants diverge from the approved spec.

The data-plane I=E Conformance Engine — BPMN parser, invariant evaluator, verdict producer, evidence recorder — scores every execution against its contract and writes verdicts to a persistence layer used for replay, audit, and regulatory review. Governance stops being a document and becomes a test.

Stack: Golang · BPMN · AWS CDK · CI/CD gate checks · immutable audit trail

gRPC decisioning services in Golang behind a BFF layer exposing REST to consumer applications, secured with mTLS and OPA-based authorization. Serves 50M+ decisions daily at sub-millisecond latency. Fronted by Decision Control Plane REST APIs with multi-auth support (OAuth 2.0, API key, JWT) and per-tenant IAM policies over DynamoDB audit state. Instrumented end to end with OpenTelemetry and SLO-based automated paging.

Stack: Golang · gRPC · BFF · mTLS · OPA · DynamoDB · OpenTelemetry

Golang onboarding control plane on AWS CDK that provisions and governs 50+ tenants, each in a VPC-isolated, Route 53-routed environment. SQS/Lambda event-driven autoscaling with DLQ error isolation, locked down with KMS, IAM permission boundaries, and Secrets Manager. The control-plane governance UI — conformance dashboard, invariant-breach alerting, and immutable audit trail — turns tenant behavior into evidence-backed reporting for engineering, risk, and audit stakeholders.

Stack: Golang · AWS CDK · SQS/Lambda · KMS · Route 53 · CloudWatch

Graph-based orchestration platform in Java/Spring Boot on Fargate and Step Functions, paired with a Graph Execution Engine that runs those decisioning graphs in the deployed data plane. On top of it, Rules Lab lets analysts author, simulate, and promote decisioning rules against the same graph runtime that serves production traffic — shortening rule turnaround without a code release.

Stack: Java · Spring Boot · Fargate · Step Functions · Lambda

Directed an 8-engineer rewrite of a legacy C++ self-checkout SDK into Golang microservices on GKE, defining the service patterns used across cart, POS, and loyalty. Cut transaction latency 30% and lifted customer adoption from 35% to 65%. Designed the BFF layer (gRPC internally, REST externally) with MQTT pub/sub and Redis-backed session state, and applied mutual TLS between GKE services and POS devices under least-privilege Cloud IAM.

Integrated Claude into the team's engineering workflow for C++-to-Go translation, code review, and test-harness generation — accelerating the rewrite and standardizing service patterns across the group. Reached 95% automated coverage and delivered milestones 15% ahead of schedule.

Stack: Golang · GKE · gRPC · MQTT · Redis · Terraform · Helm · Claude

Two-phase credit-data migration off the mainframe stack using SAFENET HSM-encrypted staging and Kafka/Scala CDC — 70% runtime reduction with zero PII exposure, secured end to end with IAM roles, KMS CMK encryption, Direct Connect VPC routing, and Splunk anomaly alerting. Rebuilt dispute processing as an async graph platform on Amazon Neptune, modeling creditor relationship graphs for sub-200ms lookups behind SQS/DLQ-backed REST APIs.

Stack: Scala · Golang · Kafka/MSK · Aurora · Amazon Neptune · SAFENET HSM · Splunk

Start here — three repos, in order:

1. payments-platform — a multi-tenant payment gateway in Go. Nine deployables, hexagonal, no framework. A twelve-step durable saga onboards merchants; a scored-routing orchestrator executes. Read this one if you want to see how I structure a system.

2. db-migration-platform — zero-downtime, self-verifying database migration. LSN-fenced writes, watermark-based snapshot/CDC, hierarchical digest reconciliation, and a cutover gate that is a proof rather than a checklist. Read this one if you want to see how I think about correctness.

3. request-journey — one web request across browser, DNS, TLS, AWS, Kubernetes, data stores and observability, plus 16 failure modes, all runnable. Read this one if you want to see how I explain things.

Also public:

• agentgate — provider-agnostic control plane for enterprise AI agents ·
• vertex-sco-platform — event-driven self-checkout edge platform ·
• zero-trust-api-gateway — identity-aware reverse proxy, sub-2ms p50 ·
• specforge — governed spec-driven engineering, hash-chained audit trail ·
• infoblox-ipam-operator — CRD-based IPAM allocation with drift detection .

Open to collaborations on cloud-native architecture, platform engineering, and distributed systems.