Open to the right challenge

Senior Software Engineer · Healthcare & Identity

I solve hard problems and deliver — secure, compliant, built to last.

Seven years designing and shipping SaaS platforms for healthcare, identity and multi-tenant products — from architecture and system design to production, with security and compliance built in.

See case studiesTell me your problem
  • Architecture & system design
  • Security & privacy
  • Compliance by design
  • Scale & performance

Bring me a problem like…

Scale & performance
A platform that has to grow — or has grown slow — and can't afford a rewrite.
Security & privacy
Sensitive data — PHI, PII, credentials — that must never leak.
Compliance
A product that has to stand up to HIPAA, NABH or an audit.
Identity
Many apps and logins that should feel like one. Okta certified.
Architecture
A monolith that needs to become reliable services — safely.
How we'd work
Remote from Kathmandu · open to the right role or engagement.
years building
7
verified certifications
4
industries
3

Principles

What I won't compromise on.

In priority order.

  1. Solve the real problem

    Find the problem that matters and ship a working, verified solution — not just code.

  2. Security first

    Customer data isolated, PHI and PII protected, every change checked before it ships.

  3. Compliance by design

    HIPAA, NABH and audit trails designed in from the start, never bolted on later.

  4. Performance & scale

    Fast today, and built to stay fast as usage grows — without a rewrite.

  5. Standards that last

    Proven standards over clever shortcuts, so the system is still easy to change years later.

Experience

Three roles, one habit: fix the hard thing properly.

  1. – nowcurrent

    Senior Software Engineer

    Healthcare software

    Problem
    Healthcare systems must stay reliable and fast while protecting sensitive patient information.
    Delivered
    Secure, well-tested services designed for privacy from the start and verified before they ship.
    Details
    • Designs and builds healthcare platform services with privacy and auditability built in.
    • Protects PHI and PII through encryption, least-privilege access and access logging.
    • Uses AI-assisted engineering for development, review and testing — with human verification.

  2. –

    Senior Software Engineer

    Identity & access management for enterprise clients, US & Europe

    Problem
    Large clients ran dozens of applications behind several identity systems that did not talk to each other.
    Delivered
    One single sign-on experience, automated user lifecycle, and a move to a cloud identity platform with no user re-onboarding.
    Details
    • Delivered federation, single sign-on and platform upgrades for enterprise clients in sports media and banking, across OIDC, SAML and OAuth 2.0.
    • Built automated provisioning and a bulk, auditable migration from a self-hosted identity provider to Okta — no user re-onboarding.
    • Modernised legacy identity connectors for performance and maintainability; brought static analysis into the pipeline.
    • Built an internal pre-sales estimation tool that improved estimate accuracy; mentored engineers and earned three Okta certifications.

  3. –

    Full Stack Developer

    Education software, multi-tenant SaaS

    Problem
    Schools needed HR, CRM, content and online exams on one platform without a separate copy per customer.
    Delivered
    Tenant-isolated modules on a stronger shared foundation; the rebuilt CRM ran about 25% faster.
    Details
    • Designed and built HR & payroll, CRM, content and online-examination modules on one multi-tenant platform.
    • Led the CRM re-architecture for usability, maintainability and scale — about 25% faster on hot paths.
    • Modularised a monolith and containerised it on AWS, cutting manual deployment time.
    • Contributed to the multi-tenancy redesign that made onboarding a new institution routine.

Independent build · personal project

A multi-tenant healthcare & enterprise SaaS platform, designed and built independently.

My own platform, built in my own time to prove these practices end to end: a modular monolith being split into microservices, event-driven integration, tenant isolation enforced in the database, GitOps delivery on AWS, a shift-left security pipeline, and compliance features — PHI access logging, HIPAA-aligned safeguards and NABH-ready clinical workflows.

  • Monolith → microservices
  • Event-driven integration
  • Multi-tenant SaaS
  • Tenant isolation at the data layer
  • AWS · infrastructure as code
  • GitOps delivery
  • Shift-left security
  • PHI access logging
  • HIPAA-aligned safeguards
  • NABH workflows
  • End-to-end test gates
  • AI-assisted engineering

Patterns proven here: tenant isolation that fails closed and reliable event-driven integration. No name, no code, no customers — by design.

Verified credentials

Certified in identity and security.

Master of Computer Science in progress · BSc Computer Science, 2019

Case studies

Three problems I have solved, shown as patterns.

Anonymised and generic on purpose — no products, no customers, no data. Each diagram animates the idea.

Tenant isolation that fails closed A request carrying tenant A's context reaches the service, then the database row policy. Rows for tenant A return 200; a lookup for tenant B's row is refused and answers 404. Requesttenant A Servicetenant header DB policyrow-level tenant A row · 200 tenant B row · 404 No ambient tenant · wrong tenant → 404, not 403
Tenant context flows request → service → database policy. The wrong tenant gets a 404, so the row's existence never leaks.

Tenant isolation that fails closed

Many organisations share one SaaS platform. The database itself refuses cross-tenant reads, so a bug in application code cannot expose another customer's data.

Problem
Shared platform, zero tolerance for data leaks
Approach
Explicit tenant context; database row-level policies as the last line of defence
Result
Isolation holds even when application code is wrong
See a reference implementation (opens in a new tab)
Identity federation and zero-downtime migration Three identity providers feed one single sign-on layer that serves many applications. Below, users move from a self-hosted identity provider to a cloud provider through SCIM provisioning without re-onboarding. SAML IdP OIDC IdP LDAP SSO layerone login Applicationsone session Self-hosted IdPusers · groups Cloud IdPno re-onboarding SCIM Federate now · migrate underneath · no downtime
Several identity providers feed one sign-on layer; users are provisioned to the new cloud provider while the old one keeps working.

Identity federation and zero-downtime migration

Enterprises rarely have one login system. Federate what exists, then move users to a cloud identity platform in the background so nobody signs up again.

Problem
Several login systems, one expected experience
Approach
Standards-based federation; automated, auditable provisioning
Result
Single sign-on across the estate; migration with no re-onboarding
See a reference implementation (opens in a new tab)
Reliable event-driven integration A service writes a fact and an event in one transaction to an outbox table. A relay publishes to Kafka in order. An idempotent consumer applies events one, two and three; a duplicate of event two is absorbed and nothing is applied out of order. Servicefact + event Outboxrelay → Kafka Kafka topicordered per key Idempotent consumerdedupe by constraint 1 2 2 3 1 → 2 → 2 (dup absorbed) → 3 · in order Absolute values · retry in place, no delay topic
Fact and event are written together; the stream keeps order; the consumer drops the duplicate "2" and applies 1, 2, 3 in sequence.

Reliable event-driven integration

Microservices must share facts without losing, doubling or reordering them. The event is saved with the data, delivered in order, and absorbed if it arrives twice.

Problem
Cross-service updates that must never double-apply
Approach
Transactional outbox; ordered streams; idempotent consumers
Result
Redeliveries and replays are safe by construction
See a messaging demo (opens in a new tab)

Capabilities

End to end, from design to production.

Broad where it matters, deep where it counts.

Architecture & system design

  • Microservices & distributed systems
  • Event-driven design
  • Multi-tenant SaaS
  • Domain & API design

Scalability & performance

  • Horizontal scaling & caching
  • Query and data-model tuning
  • Load and latency budgets
  • Resilience under failure

Development

  • Backend platforms & APIs
  • Data modelling & migrations
  • Clean, reviewable code
  • AI-assisted engineering

Testing & quality

  • Test strategy, unit to end-to-end
  • Integration & contract tests
  • Automated quality gates
  • Accessibility (WCAG 2.2 AA)

Cloud & CI/CD

  • AWS
  • Continuous integration & delivery
  • GitOps & containers
  • Infrastructure as code & observability

Security & privacy

  • Secure SDLC & threat modelling
  • PHI & PII protection
  • Encryption & key management
  • Supply-chain & secrets security

Identity & access

  • Okta certified (three credentials)
  • Single sign-on & federation
  • OAuth 2.0 · OIDC · SAML
  • User provisioning & lifecycle

Compliance

  • HIPAA-aligned safeguards
  • NABH accreditation workflows
  • Audit trails & tamper evidence
  • Data-privacy & retention rules

Standards I design against

  • HIPAA health data
  • NABH hospital accreditation
  • OWASP ASVS · Top 10
  • WCAG 2.2 AA accessibility
  • OAuth 2.0 · OIDC identity
  • SOC 2 · ISO 27001 control evidence
  • Data privacy PII · consent · retention

How I use AI

AI-accelerated. Human-accountable.

AI does the volume; I own the judgement — faster, leaner delivery without loosening a single commitment.

  1. Standards live with the code

    Architecture, security and compliance rules sit in the repository, so every AI agent works to the same bar as every engineer.

    consistent quality

  2. The right model for each job

    Capable models for design decisions, faster and cheaper ones for routine changes and checks.

    lower cost

  3. Parallel agents, isolated

    Independent work fans out to agents on separate branches; results come back reviewed, never merged blind.

    faster delivery

  4. Context discipline

    Focused reads, filtered logs and concise agent output keep spend proportional to the task.

    less waste

  5. Machines verify, then I do

    Every change passes tests, security scans and a real-browser check before it reaches review.

    fewer defects

  6. Sensitive data never leaves

    No PHI or PII in prompts, least-privilege tools, and a human approves anything irreversible.

    privacy kept

Code on GitHub

Reference implementations you can read.

Small public demos that show the patterns, not the products. The real platforms stay private.

All repositories (opens in a new tab)

How I work

Security and compliance are checkpoints, not afterthoughts.

  1. Discover

    Understand the real problem, the users and the rules it lives under.

    threat model

  2. Design

    Architecture that scales, fails closed and stays auditable.

    isolation & audit

  3. Build

    Small, reviewed changes; AI helps, engineering standards keep it honest.

    static analysis

  4. Verify

    Unit, integration and end-to-end tests through the real path.

    cross-tenant tests

  5. Ship

    Automated pipelines, signed artifacts, rollback is one step.

    signed & scanned

  6. Operate

    Monitoring, alerts and access logs; learn from every incident.

    access logging

Contact

Have a hard problem that has to ship right? Let's talk.

I reply within two working days.

e.g. name@company.com

↑ ↓ navigate · ↵ select · esc close