Shawaz Imam

Open to backend & platform roles · Remote or hybrid (US)

Backend & platform engineer. Multi-tenant Postgres, real-time voice AI, and Rust in production.

I'm the founder and CTO of a property-tech startup, and I built its multi-tenant property-maintenance platform. It answers resident calls with an AI voice agent, triages emergencies, dispatches vendors, and bills through Stripe. It runs in production for a paying customer, and I own all of it: schema, APIs, UI, CI/CD, infrastructure, and the on-call pager.

Read the case study Résumé Email GitHub LinkedIn
85Postgres tables, with forced row-level security on every org-scoped one
1,154test spec files, plus end-to-end and live contract suites gating deploys
7billing defects that passed mocked tests, now pinned by live Stripe contract tests
9languages in the product UI, including right-to-left

Selected work

Things I've built and operate

Most of this lives in private repositories for client and security reasons. I'm glad to walk through the architecture and code in an interview.

Flagship · in production2026 – present

Multi-tenant property-maintenance platform with an AI front desk

Residents reach it by phone, SMS, email, or web. It triages each request, opens work orders, dispatches vendors, syncs to the customer's property-management system, and drafts replies for staff to approve.

  • Tenant isolation in the database: forced Postgres row-level security on every org-scoped table, a least-privilege runtime role, and transaction-scoped context, so pooled connections can't leak data between orgs. Cross-org attack tests run in CI.
  • Real-time voice agent: carrier media streams → streaming speech-to-text → LLM → text-to-speech, with cross-vendor fallback and a synthetic-caller harness that places real phone calls in tests.
  • Safety-critical triage: life-safety and seasonal no-heat floors that org config can't lower, and an emergency dispatch cascade that pages on-call staff when every vendor has been tried.
  • Stripe billing: signed webhooks, protection against out-of-order events, and idempotency keys hashed from request parameters, all checked by a live contract suite against the Stripe sandbox.
  • Full SDLC, owned: NestJS API, worker, and realtime services; Next.js dashboard; Expo mobile app; 129 migrations. Test-driven throughout, with a 12-job GitHub Actions pipeline and a one-command deploy with rollback behind a Playwright gate. Terraform for GCP.
Read the case study: architecture, decisions, and incidents →
  • TypeScript
  • NestJS
  • Next.js
  • Expo
  • PostgreSQL
  • Drizzle
  • Redis / BullMQ
  • Python
  • Pipecat
  • Twilio / Telnyx
  • Stripe
  • Terraform
  • GCP
Python · MCP · in production2026

Guarded AI agent over a property-management API

An MCP server that lets an LLM agent read and change operational records, with safety enforced in code rather than in the prompt.

  • Writes follow propose → confirm → execute. Execution consumes a single-use HMAC token bound to the exact tool, endpoint, and payload, and rejects any mismatch, replay, or expiry.
  • Every read carries its evidence: endpoint, status, retrieval time, and entity IDs, so the agent can't invent an answer.
  • Three-layer egress cage: per-user iptables, a hostname-allowlist proxy, and a kernel cgroup IP deny, verified every minute by a self-healing watchdog. 152 tests.
  • Python
  • MCP
  • httpx
  • NixOS
  • systemd
  • iptables
Rust · in production2026

Spreadsheet sync and AI cost-review service

Replaced fragile spreadsheet scripts with a typed service that keeps operational ledgers in sync and flags unusual charges.

  • Diff-based reconciliation with atomic batch writes, formula preservation, and UUID idempotency stamps, triggered by HMAC-verified webhooks.
  • A production-sheet guard: nothing touches a live sheet without an explicit opt-in.
  • LLM reviewers on local and cloud backends keep per-row state, so only new or changed rows are reviewed. 244 tests.
  • Rust
  • tokio
  • Axum
  • Sheets API
  • Ollama
Python · Voice · in production2026

Local-LLM phone agent

A telephony agent that answers inbound calls with no cloud AI: speech recognition, the language model, and speech synthesis all run on local hardware.

  • Inbound SIP calls stream G.711 audio over a hand-rolled WebSocket server, with energy-based voice-activity detection per call.
  • Speech-to-text and text-to-speech run in persistent worker processes over a length-prefixed binary protocol, so no turn pays a cold start.
  • A call state machine handles phases, timeouts, and field extraction, and every turn records STT, LLM, and TTS latency. 84 tests.
  • Python
  • asyncio
  • faster-whisper
  • Ollama
  • Kokoro TTS
  • SIP

How I work

Evidence over optimism

Test that it runs

Green tests aren't the same as working software

The platform once had 398 passing tests and couldn't boot. A required smoke-boot job now checks that it actually runs, and on its first run it found two real bugs.

Verify against reality

Mocks prove intent, not correctness

Third-party APIs get live contract suites and controlled experiments. That's how I learned one vendor returns 200 for fields it silently ignores.

Test-driven

No fix without a failing test

TDD, red then green: every change starts with a test that fails for the right reason. For the voice agent, that test is a real phone call placed by the harness.

Secure by construction

Make the wrong thing impossible

Row-level security, schema-level data isolation, single-use confirmation tokens, and constant-time signature checks. The guarantees live in code, not in docs.

Experience

Where I've worked

  1. Mar 2026 – Present

    Founder & CTO

    Property-tech SaaS startup

    • Sole engineer on the maintenance and AI front-desk platform above, from design through production operations.
    • Integrated property-management, telephony, SMS, and payment systems. Mapped undocumented vendor behavior through controlled sandbox experiments.

  2. Dec 2024 – Present

    Facilities Manager

    Property management company · Greater Boston · 25 properties, 150 units

    • Triage maintenance requests, dispatch maintenance, and meet on site with vendors, clients, and tenants.
    • Staff the 24/7 emergency line and respond to emergencies in person.
    • Run logistics for all management operations: tenant, vendor, and owner communications, billing-data normalization, and monthly reports.

  3. Feb 2024 – Present

    Hyperbaric Chamber Installation & Maintenance Technician

    Oxygen Health Systems · Independent contractor

    • Installed 8 hard-shell and soft-shell hyperbaric oxygen chambers at client sites.
    • Maintain 3 of those chambers on a regular schedule, and diagnose and repair unexpected failures.
    • Monitor clients during their chamber sessions when needed.

  4. Aug 2023 – Present

    Independent Software Engineer

    Custom software for clients

    • Custom websites and utilities for clients, built with modern web stacks and Rust and deployed on Linux and GCP.
    • Includes the three production services above.

  5. 2016 – Present

    Self-Taught Automotive Mechanic

    Hands-on repair and upgrades

    • Brakes: calipers, pads, rotors, hoses, drum brakes, brake-line splicing, and bleeding.
    • Suspension and steering: ball joints, inner and outer tie rods, CV axles, wheel bearings, lug stud replacement.
    • Engine and drivetrain: transmission work, alternators, starters, spark plugs, exhaust replacement, oil changes.
    • Electrical and interior: subwoofer and amplifier wiring, head-unit upgrades, dash cams, headlights, headliner reupholstery, wheel refinishing.

Skills

Toolbox

Tools I use in production and am happy to go deep on in an interview.

Languages

  • TypeScript
  • Rust
  • Python
  • SQL
  • JavaScript
  • Bash

Backend

  • NestJS
  • Node.js
  • Axum
  • tokio
  • Actix-web
  • REST
  • WebSockets
  • Webhooks

Frontend

  • React
  • Next.js
  • Expo
  • Tailwind
  • Playwright
  • i18n / RTL

Data

  • PostgreSQL
  • Row-level security
  • Drizzle
  • SQLx
  • Redis / BullMQ
  • SQLite

AI & voice

  • LLM tool use
  • MCP servers
  • RAG
  • Pipecat
  • Streaming STT / TTS
  • Ollama

Infra & delivery

  • GCP
  • Terraform
  • Docker
  • GitHub Actions
  • TDD
  • CI/CD
  • Linux
  • Cloudflare

About

Operator-turned-engineer

I taught myself to program in 2018 (Python, JavaScript, Flask, Git, and Linux) and still learn that way. I formalised it with a full-stack program in React and Django, and now do three things: I manage facilities for a 25-property, 150-unit portfolio; I'm founder and CTO of a property-tech startup; and I build custom software for clients. I've been the person the emergency calls actually reach, which is why the platform's triage rules are strict.

I own the whole software development lifecycle, from design doc to deploy to on-call, and I work test-driven. I develop with AI coding agents every day, under strict gates: a failing test before each fix, CI that proves the app actually boots, and live contract tests against real third-party APIs. The speed comes from the agents. The correctness comes from the gates.

Away from the keyboard, I've spent ten years as a self-taught mechanic. Isolating a fault in a car and isolating one in production take the same habit: reproduce it, test one hypothesis at a time, and verify the fix. Since 2024 I've also installed 8 hyperbaric oxygen chambers as an independent contractor, and I still maintain 3 of them on a regular schedule.

  • FocusBackend · Platform · Applied AI
  • PracticeTDD · Full SDLC · CI/CD
  • Primary languagesTypeScript · Rust · Python
  • DataPostgreSQL · Redis
  • CloudGCP · Terraform
  • BasedUS · Remote or hybrid
  • Coding since2018 · self-taught
  • EducationB.A., UMass Amherst

Contact

Let's build something that holds up in production.

I'm looking for backend, platform, or full-stack roles, especially on teams building real-time systems, multi-tenant SaaS, applied AI, or Rust. Email is the fastest way to reach me.

shawaz@shawaz.org Download PDF résumé