Principal engineer for production multi-tenant AI SaaS and applied AI platforms — not demos. Own the backend and cloud for an AEC estimation AI product on AWS Canada Central: Python/FastAPI (Lambda, CDK, Aurora Serverless v2), multi-tenant Cognito security, Stripe billing (signature-verified webhooks, subscription lifecycle, reconciliation), a LiteLLM inference gateway and AI cost-governor, and RAG-retrieval correctness engineering. Previously solo-shipped an event-driven AI-SDR platform on GCP (Cloud Run, Pub/Sub, provider-abstracted Strands agents across Vertex AI / Ollama / LiteLLM, human-in-the-loop compliance) alongside GenAI infrastructure — RAG, MCP, multi-agent orchestration. Runs a personal applied-AI lab spanning RAG, MCP, and diffusion MLOps (see Projects). Prior: long-run digital health platforms (100k+ users, 99.5% uptime, OAuth/SAML federation). Focus: agentic systems & MCP, multi-tenant AI SaaS backbone, inference economics and AI cost governance. 16+ years shipping systems end-to-end.

Skills

Agentic AI Engineering

  • Multi-Agent Orchestration (Claude Code, Strands Agents)
  • AI Coding-Agent Harnesses (hooks, skills, plugins, fail-closed gates)
  • Model Context Protocol (MCP) Servers & Integration
  • Agent Guardrails & Tool Policies
  • Human-in-the-Loop Approval Workflows
  • Browser Automation for Agents (Playwright, Chrome DevTools Protocol)

LLM Platform, LLMOps & Retrieval

  • LLM Gateway (LiteLLM, OpenAI-compatible)
  • Multi-Provider Inference (OpenAI, Vertex AI / Gemini, Amazon Bedrock, Ollama)
  • LLM Observability & Tracing (Langfuse, OpenTelemetry)
  • AI Cost Governance (budget kill switch)
  • AI Usefulness Telemetry
  • Evaluation Harnesses
  • RAG, Embeddings & Vector Search (pgvector)

Backend & Frontend

  • TypeScript
  • JavaScript
  • Node.js
  • Python
  • FastAPI
  • Express
  • Next.js
  • React
  • Prisma
  • SQLAlchemy / Alembic
  • Zod
  • REST API Design
  • Bash

Cloud (AWS & GCP)

  • AWS Lambda
  • API Gateway
  • EventBridge
  • SQS
  • Fargate / ECS
  • AWS Batch
  • Cognito
  • WAF
  • Aurora Serverless v2
  • RDS Proxy
  • Secrets Manager
  • CloudWatch
  • X-Ray
  • GCP Cloud Run
  • Pub/Sub
  • Firestore

Architecture & Data

  • Event-Driven & Distributed Systems
  • Idempotency & At-Least-Once Delivery
  • Multi-Tenant SaaS
  • Stripe Billing & Webhooks
  • Architecture Decision Records
  • PostgreSQL (Aurora, Neon)
  • MongoDB
  • Redis / Valkey
  • Data Modeling & Migrations

Platform Engineering & Delivery

  • AWS CDK
  • CloudFormation
  • Terraform / OpenTofu
  • GitHub Actions (OIDC keyless deploys)
  • Nix (flakes, nix-darwin, NixOS)
  • Docker
  • Release Engineering
  • Observability
  • Incident Response & Runbooks
  • Root-Cause Analysis

Quality & Security

  • pytest
  • Vitest
  • Ruff
  • Mypy
  • cdk-nag
  • gitleaks
  • Least-Privilege IAM
  • Threat Modeling
  • OAuth 2.0 / OIDC
  • PKCE
  • SAML 2.0
  • JWT

Generative Media R&D (personal)

  • ComfyUI
  • Diffusion & Video Generation
  • GPU Cloud (RunPod, Vast.ai)

Work Experience (7)

Mar 2026 - Current
Principal Software Engineer
Infin8 Information Technologies
  • Python 3.12
  • FastAPI
  • AWS Lambda
  • AWS CDK
  • Aurora Serverless v2
  • Cognito
  • Stripe
  • LiteLLM
  • AI Cost Governance
  • Idempotency / Exactly-Once
  • GitHub OIDC CI/CD
 https://infin8it.ca/
Principal engineer for Takeoff — a multi-tenant AEC estimation AI / digital-takeoff SaaS on AWS Canada Central.
  • Own the backend & cloud platform: Python 3.12 monorepo, FastAPI on AWS Lambda, multi-stack AWS CDK
  • Multi-tenant security: dual audience-isolated Cognito pools with per-Lambda authorizer wiring, a layered regional WAFv2 WebACL, Aurora Serverless v2 + RDS Proxy (IAM auth)
  • SaaS billing on Stripe: free/trial/paid lifecycle, signature-verified webhooks, Stripe-to-database reconciliation
  • Applied-AI platform for the document-AI worker fleet: an OpenAI-compatible LiteLLM inference gateway (built, then a disciplined teardown) and an AI cost-governor with a fail-closed kill-switch; diagnosed a by-construction-invisible RAG failure — provider/dimension drift silently collapsing vector search to keyword-only scoring while self-reporting success — closed with a CI parity test making it structurally impossible to reintroduce
  • Cross-cutting platform reliability across a 20+ Lambda monorepo: a serverless Alembic migration-runner (PG advisory-lock serialized, offline SQL dry-runs), a fleet-wide async-worker idempotency contract for exactly-once effect, and structured observability (Lambda Powertools + X-Ray correlation IDs)
  • CI/CD via GitHub Actions with GitHub OIDC (no stored keys), two-speed hotswap/full-CFN deploys, a pre-production gate (staging, later an ephemeral release-candidate slot), Alembic migration runner, and Bruno smoke tests; agent-fleet guardrails treating the LLM dev-agents as untrusted actors
Aug 2024 - Mar 2026
Principal Software Engineer
Silver Creek Insights Inc.
  • GenAI
  • RAG
  • MCP
  • Multi-Agent (Strands)
  • Provider-Abstracted Inference
  • Vertex AI / Ollama
  • Event-Driven
  • Pub/Sub
  • GCP Cloud Run
  • Serverless Microservices
  • Idempotency / At-Least-Once
  • AI-SDR
  • Neon Postgres
  • HITL
  • IaC
 https://silvercreek.ai
Principal engineer across two workstreams: GenAI infrastructure (provider-abstracted inference, LLM pipelines, MCP and RAG implementations), and DontSell.ai — an event-driven, Pub/Sub-based autonomous-outbound (AI-SDR) platform built solo as a fleet of GCP Cloud Run microservices.
  • Architected provider-abstracted GenAI inference — Strands Agents behind one LLM_PROVIDER across Vertex AI (prod), local Ollama (offline dev), and a LiteLLM proxy — so identical generation code runs free-local or managed-cloud via one switch
  • Delivered multi-GPU inference serving on vLLM / Kubernetes — ~25% cost and ~40% latency reduction on that platform
  • Built DontSell.ai solo: an event-driven, Pub/Sub-coordinated AI-SDR platform as a fleet of serverless GCP Cloud Run microservices — signal ingestion, explainable versioned account scoring, ICP synthesis, and outreach-draft generation
  • Hardened the message pipeline for at-least-once delivery — HMAC-verified webhook ingestion, idempotent upserts, and poison-message ACK semantics across every worker
  • Designed the human-in-the-loop (HITL) outreach lifecycle with compliance-by-design: a 6-state approval-gated draft queue, immutable AI-disclosure, and anti-spam governance baked into the schema
  • Productionized agentic-AI pipelines on robust cloud infrastructure with scalability, observability, security, IaC, and CI/CD
Oct 2017 - Jul 2024
Senior Software Engineer
Homewood Health Inc.
  • Next.js
  • React
  • Node.js
  • AWS
  • Terraform
  • OAuth 2.0 / SAML
 https://homewoodhealth.com
Worked on Canada's leading digital mental-health platform (homeweb.ca), delivering EFAP and CBT solutions to 100k+ employees nationwide.
  • Inherited and revitalized an abandoned, undocumented MEAN-stack application into a maintainable, production-ready platform with 99.5% uptime
  • Rebuilt the authentication system with OAuth 2.0 PKCE for SSO integration with Microsoft Identity Platform, supporting 25,000+ users
  • Collaborated with federated vendors to configure and troubleshoot SAML 2.0, enabling seamless login across 5+ partner organizations
  • Led the complete frontend migration from AngularJS to Next.js on framework EOL, preserving UI/UX and API compatibility
  • Established DevOps practices — automated testing, CI/CD (cut deployment from 4 hours to 20 minutes), containerization, monitoring, and backups
  • Led infrastructure migration from DigitalOcean to AWS (EC2, RDS, S3, CloudFront, VPC) using Terraform, achieving zero-downtime deployment
Feb 2019 - Jun 2019
IT Consultant
Scotiabank
  • IBM OpenPages
  • Cognos Analytics
  • IBM AIX
  • Angular
  • Java
  • Bash
 https://scotiabank.com
Concurrent short-term contract (alongside Homewood) for scheduled maintenance of business-critical legacy IBM systems, executing upgrades and infrastructure improvements with zero downtime.
  • Executed zero-downtime upgrades of 3 IBM OpenPages GRC and 3 Cognos BI environments (7.3→8.0.0.2, Cognos 10→Analytics 11) with full business continuity
  • Configured an IBM AIX load-balanced HA cluster and automated the upgrade process end-to-end with Bash
Apr 2016 - Aug 2017
Lead Software Engineer
Etuper Technologies Pvt. Ltd.
  • Microservices
  • OpenAPI
  • AngularJS
  • SQL
 https://etuper.com
Built a complete hospitality software suite (Brilliant Rewards) — dashboard, mobile and web apps — with loyalty programs, marketing automation, booking integration, and analytics.
  • Led development of a scalable, containerized microservices architecture with discoverable OpenAPI-spec'd services
  • Introduced development standards (coding conventions, linting, code reviews, incident management) reducing production incidents by 65%
  • Delivered multiple client applications (AngularJS web + cross-platform mobile) while managing sprint planning and stakeholder requirements end-to-end
Jun 2011 - Mar 2016
Software Engineer
RM plc
  • Java
  • Struts
  • AngularJS
  • SOAP / OpenAPI
  • Linux
 https://rm.com
Built a school MIS (RM Integris) covering student management, grade tracking, attendance, parent portals, and performance analytics.
  • Implemented an OpenAPI/Swagger bridging layer to modernize legacy SOAP APIs for RESTful clients
  • Prototyped an AngularJS interface to decouple the presentation layer from a legacy Struts/JSP architecture
  • Maintained load-balanced Linux VM clusters hosting distributed web, application, and database tiers
Jul 2010 - Jan 2011
Junior Software Engineer
POSibolt Solutions
  • HTML5
  • CSS
  • Selenium WebDriver
  • JavaScript
 https://posibolt.com
Worked on an adaptable cloud ERP (Posibolt) serving retail businesses across global industry segments.
  • Created UI mockups from SRS specifications and converted approved designs into responsive HTML/CSS templates
  • Developed integration test cases and implemented browser automation using Selenium WebDriver
  • Authored user documentation including help articles, user guides, FAQs, and product website content

Projects (4)

Local-First RAG Platform & Evidence-Gated Resume Pipeline
 https://github.com/ismailkattakath/nix-local-rag
  • RAG
  • pgvector
  • Ollama
  • Embeddings
  • Nix
  • Evidence-Gated LLM Output
A zero-key, loopback-only RAG stack (published as the MIT flake nix-local-rag): launchd Postgres + pgvector with an in-database embed() → vector(768) function (nomic-embed-text via Ollama) and HNSW cosine retrieval. Powers a ~480-document career-evidence store that gates an AI job-application pipeline — every resume claim must be corroborated by mined, git-attributed evidence before it ships.
  • In-DB embeddings — retrieval without any external API key; nothing leaves the machine
  • Evidence-gated tailoring with adversarial truthfulness cross-checks against the store
  • Dogfooded: extracted as a standalone flake, consumed back as an input
MCP Gateway Fleet (built, later retired)
 https://github.com/ismailkattakath/hyperframes-selfhost
  • MCP
  • mcp-proxy
  • OAuth
  • Cloudflare Access
  • Keychain Secrets
  • Nix
Built and ran a declarative 17-server Model Context Protocol gateway: one loopback mcp-proxy hosting Nix-pinned and stdio MCP servers for every local AI client, secrets fetched from the macOS Keychain at launch (never in argv or the store), and an allowlisted subset published through a Cloudflare Access managed-OAuth tunnel, fail-closed. Retired in 2026 in favour of per-plugin servers.
  • RCE-surface servers deliberately excluded from the shared gateway (per-client stdio only)
  • Public exposure is allowlist-only behind managed OAuth — fail-closed by default
  • Deep MCP internals fluency: transports (stdio/SSE/streamable HTTP), MCP-OAuth, server packaging
Supervised Agentic-Engineering Harness & Automation Fleet
 https://github.com/kattakath/nix-config
  • Agentic Systems
  • Agent Guardrails
  • CDP / Playwright
  • Browser Automation
  • nix-darwin
  • Claude Code
Production discipline for LLM dev-agents: a crash-safe hook supervisor (loop-breaking, incident logging) wrapping evaluation gates so autonomous coding agents cannot land broken configs; and a declarative browser-automation fleet — a dedicated CDP-driven Chromium with headed-auth/headless-work modes and Playwright sessions kept encrypted in the macOS Keychain, treating agents as untrusted actors throughout.
  • Agent guardrails as infrastructure: gitflow gates, prompt-based tool policies, fail-closed evaluation hooks
  • Reliable computer-use path: CDP/Playwright attach over extension-based control, with session credentials never plaintext on disk
  • Declarative nix-darwin/NixOS fleet management (macOS + Raspberry Pi + VMs) as the substrate
Diffusion MLOps on Rented GPUs
 https://github.com/ismailkattakath/nix-vast-provision
  • ComfyUI
  • Diffusion Models
  • MLOps
  • Vast.ai / RunPod
  • GPU Provisioning
  • Reproducibility
Production-grade provisioning for open-weight diffusion pipelines: ComfyUI node graphs (Flux-2, Qwen Image Edit, LTX audio+video I2V; 17–104 nodes with tuned samplers, stacked LoRAs, GGUF-quantized encoders) wrapped in reproducible one-click provisioning across two rented-GPU providers (Vast.ai, RunPod) — sha256 fail-closed model-integrity gates, pinned custom-node commits, and preflight credential probes so a broken instance never reports ready.
  • Fail-closed integrity gating: hash mismatch or missing model fails provisioning, never silently degrades
  • Cross-provider parity debugging (torch-family conflicts, provisioner lifecycle deadlocks, CDN redirect quirks)
  • Published as a standalone provisioning flake (nix-vast-provision), dogfooded from the fleet

Education (1)

2006 - 2010
Bachelor of Technology (BTech)
 Computer Science and Engineering
Mahatma Gandhi University