Melbourne, VIC · 7+ years in production

AchyutPaudel

Senior platform engineer. I design, deploy and secure production systems on Azure and AWS — containers, CI/CD, identity, telephony, and the AI layer on top of them.

AzureAWSDocker Swarm · AKSTerraformPostgreSQLISO 27001
Follow a request →Download résumé
achyut@platform — zsh
multi-tenant saas crm·docker swarm ci/cd·azure virtual desktop·cve-2025-29927 remediation·iso 27001 readiness·self-hosted 3cx·llm orchestration·30,000+ records·
multi-tenant saas crm·docker swarm ci/cd·azure virtual desktop·cve-2025-29927 remediation·iso 27001 readiness·self-hosted 3cx·llm orchestration·30,000+ records·
scroll — dive into the network
inside the platform
Seven years of keeping production boring.
the story starts with one request ↓
years in production0Nepal → US remote → Melbourne
build time cut0Webpack → Vite migration, BI Worldwide
records under automation0LLM extraction with structured output
engineers led0Distributed team, remote-first delivery
01

The life of a request

GET /api/records.listhop 01/120.0ms

A production request, traced end to end. Follow it from the edge through identity, service, data and queued work — the platform layers I design, deploy and keep dependable.

01 · resolve
Name resolution, then a TLS 1.3 handshake

Cold connection. DNS answers from cache, then one round trip negotiates TLS 1.3 and ALPN h2. This is 46 of the 69 milliseconds — connection setup, not product code.

$ curl -v https://app.your-platform.au/api/records.list
* resolve app.your-platform.au → 20.53.104.7 (cached)
* TLSv1.3 handshake · ALPN h2 · X25519
* cert *.your-platform.au · 43d remaining
distributed trace · 01JR8QK2M4V7XB3F0.0 / 68.6ms · 01/12 spans
dns + tls46ms
waf3ms
lb1ms
nginx2ms
go-auth6ms
redis0.4ms
trpc-api4ms
pgbouncer0.8ms
postgres2ms
amqp publish1ms
response2ms
first byte0.4ms
02

What I actually run

cloud & infrastructure

Azure and AWS estates, Azure Virtual Desktop, Docker Swarm and AKS, Nginx, virtual networks, load balancing, HA deployments. Terraform and certbot for everything repeatable.

AzureAWSAVDSwarmAKSTerraformNginx
m365 & unified comms

Microsoft 365 tenant administration, Exchange Online, Graph, Entra ID and identity, workflow automation. Self-hosted 3CX with SIP trunking and AI call handling.

M365GraphEntra ID3CXSIPVoIP
security

Incident response and vulnerability remediation under real production pressure. OAuth 2.0, RBAC, SSL/TLS, network hardening, and an ISO 27001 control set being written from scratch.

ISO 27001OAuth 2.0RBACIRTLS
data & messaging

PostgreSQL as the system of record, plus MongoDB and MySQL. Redis, RabbitMQ and Kafka for queues and event-driven work that must not lose a message.

PostgreSQLRedisRabbitMQKafkaMongoDB
services & languages

Go for auth, Node/tRPC for product services, FastAPI and Django for data work. Python, Go, TypeScript, SQL — chosen per problem, not per fashion.

GoPythonTypeScripttRPCFastAPI
ai systems

Azure OpenAI and AI Foundry in production: multi-provider orchestration with cost benchmarking, RAG, agentic tool-use, n8n pipelines, and a fine-tuned text-to-SQL model.

Azure OpenAIAI FoundryRAGn8nfine-tuning
release engineering

Build and release systems that turn protected commits into verified production changes: GitLab CI, CircleCI and Azure DevOps, Docker image pipelines, security gates and automated rollouts.

GitLab CICircleCIAzure DevOpsDockerrelease automation
03

A release, end to end

Push to main and walk away. The pipeline compiles, tests against real services, scans for the class of vulnerability that already bit us once, and rolls three replicas with zero downtime. Scroll to run it.

gitlab cidocker swarmtrivycertbot-dnsstart-first updates
01
Commit0s
Push to a protected main. Branch protection and a required review decide whether the pipeline even starts — nothing unreviewed ever gets a build.
main · protected · review required
02
Build18s
Dependencies restored from cache, app compiled with Vite — the migration that cut build times 42% lives here, and it pays for itself on every push.
vite · warm cache
03
Test31s
Unit and integration suites run against throwaway Postgres and Redis containers, so queue and transaction behaviour is exercised for real, not mocked away.
142 tests · ephemeral pg + redis
04
Image24s
Multi-stage Docker build takes the image from 312 MB to 94 MB, tagged with the commit SHA. Every artifact in production traces back to exactly one commit.
94 MB · tagged by commit SHA
05
Scan12s
Image and dependency scanning as a blocking stage — added after CVE-2025-29927. An unpatched framework version fails the build here, not in an incident review.
trivy + dependency audit · blocking
06
Deploy48s
Rolling update across three Swarm replicas, start-first: a new task must pass its health check before an old one drains. Users never see a gap — watch it happen on the right.
swarm · start-first · zero downtime
07
Verify9s
Health endpoints, latency and certificate expiry confirmed; wildcard TLS renewed by certbot-dns. Rollback is one command re-pinning the previous tag — not an evening.
healthz · p99 · tls · 1-command rollback
gitlab-ci · service api · main @ 9f3c1abqueued
$ git push origin main
→ pipeline #1842 · main @ 9f3c1ab · achyut
04

CVE-2025-29927, in production

baseline · monitoring
host: swarm-prod-2 · cpu utilisationscroll scrubs the timeline →
t+0 · detection
Anomalous load, no matching traffic

Sustained CPU on a production host with nothing in the request logs to explain it. Monitoring flagged the shape of the load before anyone reported a symptom.

signal ≠ user traffic
t+1 · triage
A middleware auth bypass

Traced to CVE-2025-29927 — the Next.js middleware bypass. Requests were reaching protected paths without ever passing authorisation.

cve-2025-29927
t+2 · containment
A long-running cryptominer

Found and removed a miner that had been running quietly on the host. Machine isolated, credentials rotated, blast radius mapped across the tenancy.

isolate · rotate
t+3 · recovery
Rebuild, don't clean up

The compromised host was rebuilt from a known-good image rather than patched in place — assume persistence you haven't found yet.

rebuild from image
t+4 · hardening
Fix the pipeline, not just the host

Image and dependency scanning added as a blocking stage, framework patch policy enforced, and the incident written up as an ISO 27001 control.

prevent recurrence
outcome

Cryptominer removed, host rebuilt clean, deployment pipeline gated so an unpatched image cannot reach production again.

what it changed

The incident became the argument for a formal control set — I now lead ISO 27001 readiness across the platform: policies, risk register, access reviews.

05

Three systems, in depth

case 01 · agentmanager

Multi-tenant SaaS CRM for migration & education

Hundreds of users across multiple agency tenants. I own the architecture, the Azure estate, the database and the release path — while leading a remote team of six.

the decision that mattered

Docker Swarm over managed Kubernetes: a six-person team could operate it, wildcard SSL automated with certbot-dns, and the whole release path stayed legible. Complexity we couldn't staff would have been the real risk.

outcome

Manual release steps eliminated, tenant isolation held, and email handling moved from inbox triage to classified-and-routed automatically through Microsoft Graph.

architecture · live
Go · OAuth 2.0 + RBAC
Node · tRPC services
Redis + RabbitMQ queues
PostgreSQL, tenant-scoped
call routing · 3cx · regions
case 02 · callrix

Self-hosted cloud telephony as a practice

Founded a 3CX reseller practice inside Find the Courses: self-hosted PBX deployments, SIP trunking, network configuration, and AI call automation delivered to business clients.

the decision that mattered

Self-hosting instead of reselling someone else's tenancy. It means owning firewall rules, SIP ALG behaviour and TLS on every deployment — and it means margin, control of call quality, and the ability to bolt AI answering onto a client's numbers directly.

outcome

A repeatable deployment for client PBXs, 3CX Advanced certification behind it, and AI call handling running on live business lines.

case 03 · course intelligence

30,000+ courses, extracted and queryable

An LLM course-intelligence platform on PostgreSQL, FastAPI and Azure AI Foundry, fed by an n8n scraping and extraction pipeline running at national scale.

the decision that mattered

Retiring the RAG pipeline for a fine-tuned text-to-SQL model. Retrieval was the slow, expensive part of the loop; questions about structured course data are better answered by querying the database than by re-reading documents about it.

outcome

Lower query latency and lower inference cost, with structured output holding reliably across 30,000+ records — benchmarked across providers and model tiers rather than assumed.

course ingestion control planediscover → extract → validate → upsert
source scale
30,000+ courses
query interface
fine-tuned text-to-SQL
ingestion control
scheduled + validated
06

Seven years of production

Aug 2024 – Present
Senior Software Engineer & Team LeadAgentManager / MaxiMax Education & Migration

Architected and built a multi-tenant SaaS CRM for the Australian migration and education industry — system architecture, Azure infrastructure, PostgreSQL, CI/CD on Docker Swarm, Azure Virtual Desktop and M365 workflows for a distributed workforce — while leading a remote team of six. Built event-driven workflow microservices with Redis/RabbitMQ queues behind a Go auth service, and led the CVE-2025-29927 remediation.

AzureDocker SwarmPostgreSQLGotRPCAVDM365
2025 – Present
IT Head (concurrent, part-time)Find the Courses Pty Ltd

Own technology strategy and delivery reporting to the CEO: M365 tenant administration, Azure infrastructure, company-wide automation. Founded Callrix, a self-hosted 3CX telephony practice with SIP trunking and AI call automation. Built an LLM course-intelligence platform and an n8n extraction pipeline at 30,000+ course scale.

3CXSIPAzure AI FoundryFastAPIn8nfine-tuning
May 2023 – Aug 2024
Senior Software EngineerBI Worldwide — remote, US

TypeScript/Express backend services and REST APIs with OAuth 2.0, rate limiting and request throttling. Led the Webpack→Vite migration that cut build times 42%, and built a modular React/Next.js component architecture for scalable UIs.

TypeScriptExpressOAuth 2.0ViteNext.js
Oct 2022 – May 2023
Software Engineer (Frontend & DevOps)Ingrails Pvt. Ltd.

Built CI/CD pipelines with GitLab CI and self-hosted runners, containerised applications with Docker, configured Nginx SSL/TLS. Designed a secure inventory management system focused on reliability, access control and data protection.

GitLab CIDockerNginxTLS
Aug 2021 – Sep 2022
Mid-Level Software EngineerYouth Innovation Lab

Built ViZRisk, a national natural-hazard visualisation platform (NDRRMA / BIPAD Portal) — led Mapbox GL development for flood, land-cover and catastrophe-risk layers across Nepal. Stood up and secured a GeoServer instance, and delivered the EU-funded TheYouthCAN platform to EU web-accessibility standards.

Mapbox GLReactReduxGeoServera11y
Dec 2018 – May 2021
Software EngineerFatafat Sewa Pvt. Ltd. / freelance

Node.js/Express applications on PostgreSQL and MongoDB, with Nginx hosting, SSL and security configuration. Delivered web apps for international clients including payment gateway and analytics integrations.

Node.jsPostgreSQLMongoDBNginx
07

Let's build something dependable

I design, deploy and improve secure cloud platforms — from the first request through to reliable day-to-day operations.

education & certifications
Master of Networking — Cybersecurity
Melbourne Institute of Technology · completed 2026
3CX Advanced Certification
3CX · May 2025
ISO 27001 readiness
Controls, policy and risk program — in progress
English · Nepali · Hindi
achyut paudel · senior platform engineer · melbourne, vic—
Achyut Paudel — Senior Platform Engineer