Building agent systems · Open to Staff & Principal, or SDM & EM
Senior Software Engineer, Microsoft AI — Bing Ads, Data Platform as a Service
I build systems that coordinate work at scale — fleets of AI agents that decompose, fan out, and verify before they finish.
Multi-agent orchestration · Microsoft AI, productized independently
One agent is an assistant. A fleet is a force multiplier.
Ran a real Azure migration with up to eight agents in parallel — minutes, not a night — while the human only reviewed.
/armada, armada-fan-out skill, MCP fleet observability) — generated from a canonical core with surface adapters so the integrations cannot drift./ground-rule Persistent AI operating standards that survive across Copilot sessions. The interesting part was getting there: rather than patching the CLI bundle or leaning on an unsupported custom-command directory, I reverse-engineered Copilot's local marketplace plugin schema and built on the supported path. A canonical JSON store syncs into Copilot instructions through protected markers, with atomic writes, retry/backoff and reinstall-safe migration so a re-install cannot silently drop your rules./ado-pr Governed Azure DevOps pull requests — list, inspect, approve, and merge by URL or ID, with team/author/repo/status filtering and structured output for automation. Two-phase approval: read-only inspection, explicit confirmation, short-lived action tokens, policy checks, guarded bypass.Senior Software Engineer, Microsoft AI. Joined an in-flight on-prem → Azure program; what I have owned since: Armada, Fleet Hub, the Azure networking layer and Private Link, Vault → Key Vault with drift reconciliation, and AKS job execution on ephemeral per-job VMs.
Amazon2019 — 2026Software Development Engineer. Tier-1 push notifications at ~6M events/min, 99.99%+ availability. Alexa in-app purchase 0 → ~$4M/yr. Hey Disney integration. Add to Delivery notifications for Prime members. ~$14M/yr cut from the Rekognition fleet.
Built the team's client-side metrics and alarming from zero — replacing hand-maintained monitors with generated, version-controlled ones — cut cross-service call volume by half, contributed components to a shared library adopted by 10+ teams, and led Prime Day and Q4 peak readiness. Became the only certified security reviewer in the org while still at SDE1.
Senior Software Engineer. Java/Spring Boot microservices on the Advanced Support Platform; production errors down ~45% via JVM profiling and query tuning. Technical lead for 10+ engineers. Product docs
Care.com2016 — 2017Senior Software Engineer. Acquisition funnels and instrumentation — click-through +25%, conversion +21%.
Samsung2016Senior Software Engineer. Artik marketplace features and partner portals — ~27% revenue growth.
Research Assistant on the Software Visualization project — a web IDE rendering static structure as UML and dynamic behaviour from runtime stack traces in D3 — and Graduate Teaching Assistant for Operating Systems and Mobile Application Development, where I built the automated attendance and grading system the courses ran on.
Software/Cloud Engineer, Innovative Development Team. A cross-vendor cloud management API — configuration, installation, reporting and analysis — validated in EMC² VSPEX and NetApp FlexPod labs; a cluster manager with job submission and tracking that worked independently of the underlying cluster suite; and aCube, centralised licence management over a FlexLM server.
IIT Bombay2011 — 2013Virtual Labs, Chemical Engineering. Built the Healthcare Research Consortium platform and the pre/post-viva modules, ran the lab's NAS and Linux compute server, and taught FOSS workshops for the Spoken Tutorial project under MHRD's National Mission on Education through ICT.
Where the work reaches people who do not report to me.
Authority, standards and the times somebody had to pick it up.
Amazon Security Certifier from 2020 — and the only certified security reviewer in the org while still at SDE1. The role carries design-review authority over other teams' production readiness, which means the power to say a launch is not going out. Exercised across multiple services, more than the bar required.
After roughly 60% of the team left in one quarter, I took Prime Day and Q4 peak readiness onto myself rather than waiting for it to be assigned, and carried the component work the wider org was depending on. Nobody appointed me to either.
Proposed splitting a service the team had not planned to split, wrote the design documents for both halves in parallel, and took them through review with the data behind the trade-offs. My manager was not initially convinced. The design went in as I argued it, and the second service exists because of that document.
Reusable service and infrastructure templates adopted across teams; components contributed to a shared library used by 10+ teams; a 28-skill platform toolkit that turns repeatable chores into governed workflows; and a persistent engineering-standards system so a team's operating rules survive between sessions rather than living in someone's head.
Technical lead for a 10+ engineer team at Oracle — design reviews, code reviews, performance debugging. Mentoring and cross-team design reviews at Amazon. At Microsoft I own each team's move onto the platform end to end: discovery, scoping, design review, hands-on migration of their workloads, and cutover support.
40+ open-source workshops taught across colleges in India for IIT Bombay's Spoken Tutorial project under a Government of India programme, with standing authorization to run them anywhere in the country — and a Graduate Teaching Assistant post at Texas A&M–Kingsville for Operating Systems and Mobile Application Development.
My one-year-old lost the TV remote, so I rebuilt the TV instead. Overnight, on a discontinued Meta Portal TV stripped of every app — no docs, no root, no store. By morning: a from-scratch launcher running 25+ streaming apps natively (Netflix, Prime Video, Disney+, Hulu, Spotify), 700+ live channels in 11 languages, and a content-first UI with auto-playing hero trailers and Continue Watching. Daily driver ever since.
Paste a recruiter thread — or connect the mailbox — and it extracts company, role, stage and contact into a tracked record, then reads the ICS attachment or the Outlook calendar event over Microsoft Graph and books the interview itself. There is a deterministic heuristic fallback for when no model key is configured, so the app degrades instead of failing.
Encryption is per-field, not per-database: notes, salary, recruiter identity, résumé text, raw email bodies, summaries and sentiment each AES-256-GCM encrypted at rest, IMAP passwords and OAuth tokens under a separate salt — and encrypt-on-write / decrypt-on-read live in the storage layer, so no call site can forget to do it. React and Express over Drizzle and PostgreSQL, with a 60-page high-level design behind it.
Offline-first cricket scoring: a scorer at a ground with no signal records a full match in airplane mode, and it reconciles on reconnect — the hard part being conflict and duplicate resolution, not the UI. Vanilla-JS PWA over a Node/SQLite server with a Capacitor iOS shell, a DLS rules engine, 26 test suites, and CI deploying to Azure. ~67K lines, 282 commits, all his own.
A macOS desktop app that files documents by what is inside them rather than what they are named — text pulled out of PDFs and Word files, Vision-framework OCR when a PDF is image-only, then classified, deduplicated by content hash with a keep-preference ranking, and balanced across local, iCloud, Google Drive and OneDrive accounts. The sync is deliberately timid: additive, newer-wins, and it never propagates a delete — the losing copy is kept as a .conflict file instead of disappearing. Electron shell over a Python engine with a Swift OCR helper, ~4.8K lines.
A scheduled scanner screens job boards against a role rubric, a generator edits the master .docx in place so fonts and spacing stay byte-identical rather than being re-derived, and the submit flow always stops at a human-review gate before anything is sent. Built on the open-source career-ops pipeline (santifer/career-ops, MIT).
A sports-club operations platform, built as a TypeScript monorepo — NestJS and Prisma over PostgreSQL, React/Vite on the web, Expo on mobile, with contracts shared across all three so the clients cannot drift from the API. Covers the unglamorous half of running a league: clubs, teams, players, grounds, umpires, match formats, public tournaments, scoring, and the parts most tools skip — committee elections, and promotion and relegation between divisions.
A cluster you can fly through rather than grep. A local-first FastAPI backend shells out to kubectl and a React force-graph renders the topology in three dimensions — resource identity, health, dependency paths and logs, refreshing itself as the cluster moves. Drill-down, exec, scale, restart and a command palette are wired in, but the write actions are deliberately bounded, access stays local, and credentials are masked rather than shipped anywhere.
Point it at a local directory and it compiles an architecture map you can walk — scanning incrementally, detecting and consolidating projects across a multi-project workspace, then giving you breadcrumbs, navigation history and jumps along real dependency edges. Raw code stays local by default and is never executed, and rendering is bounded on purpose so a large workspace explores rather than hanging the browser.
A live cockpit for CLI sessions where zooming the active pane does not shove the navigation and command chrome around it. The trick was moving zoom into the DOM and holding the terminal chrome static, plus an embed mode that renders the stage alone — driven by a control HTTP channel and a dock host wrapped around per-connection child processes.
Systems I owned end to end — drawn as they actually behave, including the failure paths.
The platform behind notifications like Add to Delivery, which tells a Prime member their order can still be changed — so it is only useful if it arrives before the van does. Producers fan into SNS, SQS absorbs the spike as back-pressure, Fargate workers drain it, and every write is idempotent so a replay cannot double-send. What fails retries; what keeps failing lands in the DLQ instead of blocking the queue.
The multi-region Hadoop and Spark platform where all bidding data lands, reached over Private Link — sitting on a dependency map of batch compute, an LDAP auth bridge, a MySQL metadata store, object storage, message brokers, Redis, ZooKeeper and the operational log pipelines — where single tenants run to petabytes, 1.05 PB live against a 4.98 PB quota on the largest and 4.38 PB provisioned on another, and the estate runs 38–40K job instances a day across ~2,500 scheduled jobs, on 3,400 Hadoop cores. Every job gets a dedicated VM that is destroyed on completion, so tenants are isolated and nothing idles. Platform state moves onto a zone-redundant managed MySQL — 32 vCores, 256 GiB — with its primary in one region and failover in another, replacing a single node that was backed up and patched by hand. I own the move off HashiCorp Vault and its retirement at the end of it. Secrets sync Vault → Key Vault throughout the transition, with a reconciliation pass that catches drift rather than trusting the sync — but the sync is scaffolding, not the destination. Consumers move class by class and Vault comes out when the last one is off it. Consumers were split by how they actually read secrets: direct API callers got a Key Vault client layer preserving the old logical paths and read/write/patch/delete semantics so they migrated with almost no code change, while cluster workloads kept their native Secret contracts — mounted as ephemeral files through the CSI driver, or synced back into real Kubernetes Secrets where an app still needed one, under their existing Secret names and keys — a data-governance frontend, an alerting and validation service, a capacity monitor, a log-retention job and the batch compute tier all kept working untouched. Pod identities bind to Entra workload identity, so nothing handles a credential. Retiring the old store is the risky half, so it runs on rules rather than nerve: one system is the source of truth at any moment and synchronisation is one-way, so a stale write cannot travel backwards into the store being drained. Staged migration modes let one consumer class move without the rest following, parity checks compare both stores before anything is cut, and the known failure modes are named and guarded — stale reads, incomplete listings, two patches racing the same secret — because each of those quietly produces a service that authenticates today and not tomorrow. Rollback stays available until the last consumer is off. Batch runtime came down from 21 to 11 minutes without breaking the six-hour report SLA. The sync started life as a weekend prototype — a Vault socket audit device piped through a TCP bridge into a RabbitMQ topic exchange, with a reconnecting publisher and bounded buffering, carrying event context only so the message bus never became a second place secrets live.
Purchase, entitlement validation, billing, fulfilment. The design work is the failure path: a billing timeout drops into a retry queue and replays, and because entitlement is idempotent the customer is never double-charged on replay.
Backend design and launch readiness for partner purchasing, including the account-linking handshake between Alexa and the partner. Linking load time cut by roughly 85%.
Playback state synchronised across devices so media follows the listener. The trade-off is explicit: under a partition it favours availability and reconciles after, because stalled audio is a worse failure than a briefly stale position.
Multi-room audio in the Alexa app — The VergeConnecting Spotify and Apple Music — The Verge
An always-on local dashboard that discovers fleets, sessions, agents, tasks and dependencies across Copilot, Claude and Codex session stores on both Windows and WSL, with no dependencies of its own — heterogeneous fleet JSON, agent trees and liveness signals normalised into one model with no central database behind it. New sessions register themselves through a session-start hook rather than by hand. A inuse.<pid>.lock file plus a live process check is what separates a running session from an abandoned one — so an ended fleet sorts away instead of sitting there claiming to be busy.
Services needed to leave RabbitMQ for Azure Service Bus without every producer and consumer being rewritten around it — a nine-node broker estate spread across three regions, carrying fourteen production queues. The answer was a broker-neutral MessageBus contract in Scala with explicit Complete, delayed Retry and DeadLetter semantics — so unroutable publishes, delivery counts, bounded retries and dead-letter reasons are decided once instead of per service, while the legacy MQApi call paths keep compiling.
Replacing a legacy alerting and validation system with open-source, Azure-aligned parts: a Go validation engine doing threshold and percent-difference logic, a Prometheus/Alertmanager stack with PromQL rules, an exporter and an OpsGenie mock. Alerting and validation were split into separate flows, and the whole thing runs on Docker and kind locally, wired to a shared pre-production environment — you can exercise a page before trusting it in production. Services either side are instrumented with OpenTelemetry metrics, traces and logs.
Every execution carries eight timestamps, and end-to-end latency is measured from the hour the data was for — not from the moment the scheduler happened to pick it up. Measure it the usual way and a job delayed forty minutes in a queue still reports a fast run. Splitting the interval into scheduler, pending, queue and execution means a missed SLA points at the stage that caused it instead of starting an argument.
Every owned path reports space and object counts against quota, a seven- and thirty-day growth rate, and an estimate of how many days remain until 80, 90 and 100 percent. A threshold alarm tells you that you have a problem today; a growth curve tells you which team needs to be in a room three weeks from now. Re-evaluated every ten minutes, with the cache propagation delay treated as a known lag rather than a surprise.
