Platform and backend engineer, focused on backend services, CI/CD and GitOps delivery, Kubernetes controls, telemetry, and AI systems that run on local infrastructure rather than external APIs. Work follows a single delivery path, so everything can be reviewed, released, observed and rolled back:

code → tests → immutable artifact → reviewed GitOps → runtime → telemetry → rollback

Public work is grouped below by domain; each project is labeled by scope so the evidence stays honest.

The strongest proof is in the written studies — each maps a real system to what was built, how it was verified, and what it cost:

• LC Website & Network Security Hardening — audit → remediation → verification on LC's production Next.js platform: retired the live HTML uploader, sandboxed embedded content, bounded the lead APIs, 13/13 hardened tests.
• Linguistic Communication — Public Platform, LC Academy & Operations — WordPress → versioned Next.js catalogue (299 SSG pages), staging/prod delivery on one VPS, and the LC Academy multi-agent classroom.
• Multi-Tenant GitOps Platform — CI → immutable image → reviewed GitOps → Argo CD → Prometheus-gated rollouts → rollback, on a multi-tenant Kubernetes model.
• Secure Teacher Onboarding & Document Pipeline — NAS + Cloudflare + local-API document pipeline for LC teacher onboarding.
• OpsPilot — Local-First AI Operations Copilot — RAG over runbooks with bounded, fail-closed LLM calls and Langfuse tracing.
• LLM Council — Local Multi-LLM Orchestrator — local Ollama inference behind an authenticated gateway, anonymized peer review and chairman synthesis.

A recurring thread is local AI: self-hosted inference (Ollama serving a 30B Qwen model) behind an authenticated OpenAI-compatible gateway bound to loopback, agent workflows orchestrated through Hermes gateways — including fixing a tool-call defect and validating real agent tool execution — and bounded workflows built on LangGraph and LangChain rather than dependent on external inference APIs.

Early in the contribution cycle — no upstream merge has landed yet, and that is stated plainly rather than implied otherwise. Two implementation PRs are open and awaiting maintainer review:

• OpenTelemetry JS contrib PR #3751 — new @opentelemetry/instrumentation-long-animation-frame package, the Long Animation Frames successor to the deprecated long-task instrumentation. Built to unblock PR #3669, the long-task deprecation a maintainer reviewed and asked for this replacement to precede. CLA signed.
• Grafana MCP PR #1166 — fix for the stdio transport not re-reading GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE after startup (#987), with a token-rotation regression test.

Process: reproduce the issue → propose a focused change → sign the CLA → iterate with maintainers → land. Scope is logged honestly so nothing is presented as merged before it is.

A proportionate security baseline applied to Linguistic Communication's public Next.js platform, validated in staging then production:

• Retired the live HTML uploader in favour of Git-reviewed publication.
• Sandboxed embedded content without allow-same-origin.
• Bounded the two lead APIs (quiz-lead, b2b-diagnostic-lead): content-type checks, 64 KB body cap, field/array limits.
• Bot and abuse controls: honeypot, minimum completion time, short-window duplicate suppression, SMTP rate limits.
• Edge identity and headers: trusted client-IP restoration behind Cloudflare, baseline security headers, CSP report-only, disabled X-Powered-By, Nginx body/rate limits, security.txt + data-handling policy.
• Evidence: a baseline-vs-hardened scenario harness (13/13 hardened tests pass; primary runtime/static classes 1/14 → 14/14) plus staging and production validation.

Full write-up: LC Website & Network Security Hardening — audit → remediation → verification.

Open to platform, backend, cloud, and AI-platform roles — Paris or remote. The fastest read is the six-page engineering brief; the deepest is the portfolio evidence map.

Email · LinkedIn · Portfolio