Shawaz Imam

Open to backend & platform roles · Remote or hybrid (US)

Backend & platform engineer. Multi-tenant Postgres, real-time voice AI, and Rust in production.

I'm the sole engineer on a multi-tenant property-maintenance platform that answers resident calls with an AI voice agent, triages emergencies, dispatches vendors, and bills through Stripe. It runs in production for a paying customer, and I own all of it: schema, APIs, UI, CI/CD, infrastructure, and the on-call pager.

Read the case study Résumé Email GitHub LinkedIn
78Postgres tables, with forced row-level security on every org-scoped one
1,045test spec files, plus 35 end-to-end suites gating deploys
3billing defects caught by live Stripe contract tests after mocked tests passed
9languages in the product UI, including right-to-left

Selected work

Things I've built and operate

Most of this lives in private repositories for employer and security reasons. I'm glad to walk through the architecture and code in an interview.

Flagship · in production2026 – present

Multi-tenant property-maintenance platform with an AI front desk

Residents reach it by phone, SMS, email, or web. It triages each request, opens work orders, dispatches vendors, syncs to the customer's property-management system, and drafts replies for staff to approve.

  • Tenant isolation in the database: forced Postgres row-level security on every org-scoped table, a least-privilege runtime role, and transaction-scoped context, so pooled connections can't leak data between orgs. Cross-org attack tests run in CI.
  • Real-time voice agent: carrier media streams → streaming speech-to-text → LLM → text-to-speech, with cross-vendor fallback and a synthetic-caller harness that places real phone calls in tests.
  • Safety-critical triage: life-safety and seasonal no-heat floors that org config can't lower, and an emergency dispatch cascade that pages on-call staff when every vendor has been tried.
  • Stripe billing: signed webhooks, protection against out-of-order events, and idempotency keys hashed from request parameters, all checked by a live contract suite against the Stripe sandbox.
  • Scope and delivery: NestJS API, worker, and realtime services; Next.js dashboard; Expo mobile app; 122 migrations. An 8-job GitHub Actions pipeline and a one-command deploy with rollback behind a Playwright gate. Terraform for GCP.
Read the case study: architecture, decisions, and incidents →
  • TypeScript
  • NestJS
  • Next.js
  • Expo
  • PostgreSQL
  • Drizzle
  • Redis / BullMQ
  • Python
  • Pipecat
  • Twilio / Telnyx
  • Stripe
  • Terraform
  • GCP
Rust · Research build2026

Event-driven liquidation engine

An attempt to liquidate under-collateralised lending positions with flash loans. It never landed a liquidation, but building it taught me low-latency pipeline design in Rust.

  • Simulate before submit: every candidate runs in a local EVM (revm) first, so bad trades are rejected before any RPC call.
  • Pipeline stages: monitor → scorer → queue → executor → submitter, with a 15-state lifecycle state machine.
  • RPC circuit breakers, Multicall3 batching, and p50/p95 metrics. 320+ tests, and a Solidity flash-loan contract tested with Foundry.
  • Rust
  • tokio
  • alloy
  • revm
  • Solidity
  • SQLite
  • Redis
Rust · Marketplace2026

B2B sourcing marketplace backend

A two-sided marketplace. Buyers must never see which supplier fills their order, and the database enforces that.

  • Separate Postgres schemas for buyers and suppliers, with the backend as the only writer. The buyer API can't reach supplier data.
  • Pricing can't exist without a recorded cost source, and money and audit tables are append-only.
  • Axum and SQLx across 5 crates, with 150+ tests including Testcontainers integration tests. Stripe deposits and TOTP MFA.
  • Rust
  • Axum
  • SQLx
  • PostgreSQL
  • Next.js
  • Docker
LLM agents · Security2026

Guarded AI agent over a business API

An MCP server that lets a chat-based LLM agent read and change operational records safely.

  • Writes follow propose → confirm → execute, and execution needs a single-use token bound to the exact payload. The code enforces this, not the prompt.
  • Every read cites its source endpoint and timestamp, so the agent can't invent an answer.
  • Runs as a sandboxed service whose outbound traffic is limited to a single host.
  • Python
  • MCP
  • systemd
  • LLM tool use
Rust · Data2026

Spreadsheet sync and AI cost-review service

Replaced fragile spreadsheet scripts with a typed service that keeps operational ledgers in sync and flags unusual charges.

  • HMAC-signed webhooks into an Axum server, with a scheduled reconcile job as a safety net.
  • Two independent LLM reviewers, one cloud and one on a local GPU. Runs are resumable and idempotent, and never overwrite notes people have added.
  • 240+ tests. The sheet sits behind a trait, so all the logic is tested offline.
  • Rust
  • Axum
  • OAuth2
  • Sheets API
  • Ollama

How I work

Evidence over optimism

Test that it runs

Green tests aren't the same as working software

The platform once had 398 passing tests and couldn't boot. A required smoke-boot job now checks that it actually runs, and on its first run it found two real bugs.

Verify against reality

Mocks prove intent, not correctness

Third-party APIs get live contract suites and controlled experiments. That's how I learned one vendor returns 200 for fields it silently ignores.

Reproduce first

No fix without a failing test

Every bug fix starts with a test that fails for the right reason. For the voice agent, that test is a real phone call placed by the harness.

Secure by construction

Make the wrong thing impossible

Row-level security, schema-level data isolation, single-use confirmation tokens, and constant-time signature checks. The guarantees live in code, not in docs.

Experience

Where I've worked

  1. Dec 2024 – Present

    Software Engineer & Facilities Manager

    Property management company · Greater Boston

    • Sole engineer on the maintenance and AI front-desk platform above, from design through production operations.
    • Integrated the company's property-management system, telephony, SMS, and payments. Mapped undocumented vendor behavior through controlled sandbox experiments.
    • Manage facilities for 25 properties, including 24/7 emergency response, so I'm also an on-call user of the product I build.

  2. 2016 – Present

    Self-Taught Automotive Mechanic

    Hands-on repair and upgrades

    • Brakes: calipers, pads, rotors, hoses, drum brakes, brake-line splicing, and bleeding.
    • Suspension and steering: ball joints, inner and outer tie rods, CV axles, wheel bearings, lug stud replacement.
    • Engine and drivetrain: transmission work, alternators, starters, spark plugs, exhaust replacement, oil changes.
    • Electrical and interior: subwoofer and amplifier wiring, head-unit upgrades, dash cams, headlights, headliner reupholstery, wheel refinishing.

Skills

Toolbox

Tools I use in production and am happy to go deep on in an interview.

Languages

  • TypeScript
  • Rust
  • Python
  • SQL
  • JavaScript
  • Bash

Backend

  • NestJS
  • Node.js
  • Axum
  • tokio
  • Actix-web
  • REST
  • WebSockets
  • Webhooks

Frontend

  • React
  • Next.js
  • Expo
  • Tailwind
  • Playwright
  • i18n / RTL

Data

  • PostgreSQL
  • Row-level security
  • Drizzle
  • SQLx
  • Redis / BullMQ
  • SQLite

AI & voice

  • LLM tool use
  • MCP servers
  • RAG
  • Pipecat
  • Streaming STT / TTS
  • Ollama

Infra & delivery

  • GCP
  • Terraform
  • Docker
  • GitHub Actions
  • Linux
  • Cloudflare

About

Operator-turned-engineer

I taught myself to program in 2018 (Python, JavaScript, Flask, Git, and Linux) and still learn that way. I formalised it with a full-stack program in React and Django, then went to work at a property-management company. I now run facilities for its 25 properties and build the software that runs maintenance. I've been the person the emergency calls actually reach, which is why the triage rules are strict.

I develop with AI coding agents every day, under strict gates: a failing test before each fix, CI that proves the app actually boots, and live contract tests against real third-party APIs. The speed comes from the agents. The correctness comes from the gates.

Away from the keyboard, I've spent ten years as a self-taught mechanic. Isolating a fault in a car and isolating one in production take the same habit: reproduce it, test one hypothesis at a time, and verify the fix.

  • FocusBackend · Platform · Applied AI
  • Primary languagesTypeScript · Rust · Python
  • DataPostgreSQL · Redis
  • CloudGCP · Terraform
  • BasedUS · Remote or hybrid
  • Coding since2018 · self-taught
  • EducationB.A., UMass Amherst

Public code

Open on GitHub

Contact

Let's build something that holds up in production.

I'm looking for backend, platform, or full-stack roles, especially on teams building real-time systems, multi-tenant SaaS, applied AI, or Rust. Email is the fastest way to reach me.

shawaz@shawaz.org Download PDF résumé