Regulated Brazilian fintech. Open Finance data platform, TypeScript and NestJS on AWS and Kubernetes. I led the design of the Open Finance data cache end to end and built the team's AI harness.

• Designed and built the Open Finance data cache, presented to the fintech's Open Finance board: customers' banking data is collected on a schedule and served from a read model, so a screen never spends the customer's regulatory call quota. CQRS on ingestion, append-only S3 for audit, Aurora PostgreSQL for serving, NestJS workers on Kubernetes.
• Treated the cache as a quota shield, not a speed layer. The regulator caps statement reads per account per month (8 for a date range, 240 for the recent window), so a miss returns empty and never calls the bank. I found my own design assumed the wrong ceiling before anything ran, moved the hot path to the right endpoint, and corrected the documents at the source.
• Simulated the deletion window before switching it on: a fake clock, a scripted bank, one collection per day, every scenario with the flag off and on. The simulation caught that a truncated page read counts as complete, so two truncated reads in a row would mark a live transaction as deleted. It became a precondition of the flag.
• Closed the boundary between domain libraries in the modular monolith: 66 imports reached into other libraries' internals and a dependency cycle was held together by forwardRef. Public API per library, a port for the inverted dependency, and lint rules as a fitness function so it can't come back.
• Made collection safe across workers and quota: lease-based work distribution with write fencing, call budget reserved before the call, failure on its own backoff curve instead of the success cadence, terminal state for revoked consents.
• Got data integrity without a transaction on object storage: a collection is written whole or not at all, the pointer only advances after the data lands, every unique key column is non-null, keyset pagination with an explicit tiebreaker.
• Designed the modular monolith that replaced two legacy backends by Strangler Fig with contract parity, one database per domain through named connections.
• Found the CI failures the team read as noise were pods killed by memory limits before a single test ran, and fixed the job limits by measurement. Added tag-per-commit deploys to the staging cluster so "ready" means proven on the pod.
• Ran the team's security review on payment, enrollment and consent flows: authorization scope from the token's own claims, never from an id in the URL. Every fix proven by mutation testing. Every design in C4 and an ADR before code.

Software consultancy based in Belgium, clients in Europe and the US.

A Belgium-based salon-management multi-tenant SaaS. Go backend, two Next.js frontends and the AWS infrastructure, PostgreSQL with PostGIS. Two years on this platform, from an empty repository to the features the business runs on.

• Designed the Go backend behind the salons' back office and storefront: ports and adapters, two OpenAPI-contracted APIs generated from code and drift-gated in CI, TypeScript types generated from the same contract so a DTO change breaks the frontend at compile time.
• Built the online booking customers use: an availability engine over staff, services and opening hours, recurring appointments in the tenant's timezone, a waitlist, and advisory locks so two people can't book the same slot.
• Automated invoicing for every salon: an online order becomes an invoice in the accounting ERP with no manual step. Webhook acknowledged fast and processed from a queue, idempotency by the state of the destination, dead-letter queues with alarms.
• Kept the ERP's OAuth token alive in production: rotation with compare-and-swap on DynamoDB so two refreshers can't break the chain, a circuit breaker that separates a terminal refusal from an ambiguous one, and a stop-then-start deploy so only one writer ever holds the token.
• Integrated four platforms behind the same boundary: the accounting ERP, an e-commerce platform migration, an identity provider synced by webhook, and a reviews source cached in the database. Plus a self-healing monitor that re-enables webhooks the commerce platform silently disables.
• Kept every salon's data isolated and erasable on request: shared-schema multi-tenancy with fail-closed per-tenant RBAC, and GDPR Article 17 erasure by transactional anonymisation.
• Tuned what was slow in production: a count query carrying five joins that never changed the count, cache invalidation moved from KEYS to SCAN, cursor pagination where offset skipped rows.
• Provisioned and operated the platform as code across three environments in two AWS regions: OpenTofu with plans reviewed in pull requests, autoscaled ECS Fargate, Go Lambdas on a custom runtime, CI/CD on OIDC-federated credentials, anomaly-detection alarms on the production database, Sentry with fingerprints.
• Put AI into the team's CI: automated code review on every pull request and end-to-end test agents on Playwright.

A licensed real-money game platform (online backgammon on web and Telegram). NestJS, PostgreSQL, React and Phaser/WebGL on AWS, as the only engineer, working directly with the client.

• Built card and crypto payment rails from zero, on ePay (card payment gateway) and Calypso (crypto payment gateway): the provider's unsigned callback only triggers a server-side check, credits land exactly once under concurrent webhooks (proven by the database sequence, not by logs), a scheduled sweep reconciles pending payments, and crypto payouts run on the production gateway.
• Measured the schema rollback on the money table in both directions before deploying it, so the rollback door was a deploy decision, not a risk.
• Implemented the player protection the gaming licence requires: rolling-window deposit limits with cooling-off, a single open checkout per player so concurrent checkouts can't breach the cap, session limits with forced logout, irrevocable self-exclusion, and withdrawals gated on KYC with device fraud signals.
• Built the KYC and fraud-detection integrations from scratch, on Shufti Pro (identity verification) and CrossClassify (device and behavioral fraud detection), and read the fraud vendor's API contract before a scoping meeting to show the risk model had to be ours, not configuration.
• Closed an account-takeover path in a sign-in flow that had already passed review, by inverting who may assert identity and adding proof of possession in the PKCE pattern.
• Audited every player-reachable handler for ownership checks, found the ones that forgot, and replaced per-handler checks with default-deny by route metadata. Revocation checked on every request and WebSocket, so a blocked player loses access at once, inside live games too.
• Diagnosed a white screen on iOS Safari nobody could reproduce: an instrumentation probe counted WebGL contexts and found the engine recreated on every route. Fixed with a single persistent game instance, validated by the same probe.

Allocated to Smiles (Gol Airlines), on its corporate travel platform. Technical reference for the project: architecture documents and a design review per feature.

• Serverless event-driven architecture (Lambda, SQS, EventBridge, Step Functions, CloudFormation) · corporate travel platform
• Multi-tenant authentication with Auth0 and per-tenant RBAC · corporate travel platform
• Single-table DynamoDB with hierarchical composite keys · permissions, roles and tenant hierarchy
• Multi-level approval workflow · corporate travel requests
• GDS integration (Sabre) · flight and hotel reservations
• Architecture review per feature, correcting serverless function granularity by domain boundary · corporate travel platform
• Onboarding automation with a secrets vault (Python Slack bot + 1Password) · Enkel TI internal onboarding · cut onboarding time 40%

The chat below is retrieval, not a prompt with my CV pasted in. Content is chunked, embedded and stored in a vector index, and a question retrieves the relevant pieces before the model answers. Runs entirely on Cloudflare: Pages Functions, Workers AI for embeddings and generation, Vectorize for the index. Ask it about the Open Finance cache or the payment rails. It answers from the same notes I'd defend in an interview.

Market analysis for World of Warcraft players, built and run by me: Battle.net OAuth2 written from scratch, session tokens stored as hashes, Prometheus and Grafana provisioned as code, Telegram alerts. A custom exporter cut scrape latency from roughly 14s to roughly 3s.

Built with my Cyrex team: a Slack bot that turns a team's messy conversation into a ready Jira ticket, grounded in the team's own Slack history by semantic retrieval, with a human approving every ticket. Retrieval started on Pinecone and moved to MongoDB Atlas Vector Search to drop a dependency.