Work
Card on File Network Tokenization
Issuer-side Visa and Mastercard network tokenization, built as primary owner and taken to production in 3 months.
Problem: Merchants and wallets need network tokens in place of real card numbers, and the issuing bank has to answer the networks' provisioning and lifecycle calls.
Approach: Designed and built the issuer-side services that handle Visa and Mastercard provisioning and token lifecycle calls, secured with JWT, JWE, and JWS.
Outcome: Live in production for both networks, 3 months from start.
Java, Spring Boot, Network tokenization, Visa, Mastercard, JWE/JWS
Virtual Cards and Google Pay, the first launch in Trinidad and Tobago
In-app virtual cards with secure card number and CVV reveal and wallet provisioning, which powered the first Google Pay launch in Trinidad and Tobago.
Problem: Customers wanted a card they could use the moment they asked for it, on the phone and in Google Pay.
Approach: As primary backend owner, built virtual card issuance, secure card number and CVV reveal, and wallet provisioning in 3 months, inside a 6-month program with the UI and vendor teams.
Outcome: Powered the bank's Google Pay launch, the first in Trinidad and Tobago. Apple Pay provisioning is now in rollout.
Java, Spring Boot, Kafka, PostgreSQL, Google Pay, Apple Pay
Duplicate Alerts, Fixed at the Root
A race condition sent customers the same SMS, email, and push alert more than once. Fixed with locking, claim-and-deliver, and idempotent sends.
Problem: Several scheduler instances picked up the same pending alerts, so Infobip delivered duplicates. The bank paid for every extra message, and customers reported double debits that never happened.
Approach: Added scheduler locking, row-level locks when fetching alerts, claim-and-deliver status updates, and idempotent sends, so each alert is claimed by one worker and sent once.
Outcome: Duplicate vendor charges and false double-debit reports stopped.
Java, Spring Boot, PostgreSQL, Distributed locking, Idempotency, Infobip
One API, Two Countries
A single set of APIs serving Trinidad and Tobago and Barbados, each region on its own database.
Problem: The bank runs in two countries with separate data, and duplicating every API per region doubles the work and the drift.
Approach: Resolved the region from the access token and routed each request to that region's database.
Outcome: One codebase and one set of contracts for both countries.
Spring Boot, Spring Security, OAuth2, PostgreSQL, Multi-region
Retail, Mobile & Corporate Banking
Spring Boot services in a 30+ microservice estate powering Retail Internet Banking, Corporate Internet Banking, and Mobile Banking for retail customers and hundreds of corporate clients.
Problem: Corporate clients needed new banking modules on a platform serving hundreds of organizations, under strict compliance requirements.
Approach: Designed and delivered three major corporate banking modules: REST APIs, Kafka event flows, and PostgreSQL persistence.
Outcome: Modules shipped to production and in daily use by corporate banking customers.
Spring Boot, Kafka, PostgreSQL, Redis, Microservices
TOTP Authentication & Push Approval
RFC 6238-compliant TOTP with AES-256-GCM secret storage, QR enrollment, and Redis-backed replay prevention.
Problem: Customers needed strong multi-factor authentication for logins and high-value transactions.
Approach: Implemented TOTP end to end plus push-notification approval from registered devices.
Outcome: MFA live across banking channels; replay attacks structurally prevented.
Java, Redis, AES-256-GCM, TOTP, Security
ELK + Kafka Observability
Centralized logging and cross-service search for a 30+ service estate.
Problem: Production triage meant grepping scattered logs across on-prem services.
Approach: Set up the ELK Stack with Kafka as the log transport, so every service's logs land in one searchable place.
Outcome: Production issues are traced from one search across all services.
Elasticsearch, Logstash, Kibana, Kafka
LLM Banking Assistant
A production banking assistant on Spring AI and Azure OpenAI that answers customer FAQs and checks who it is talking to before it touches an account.
Problem: Routine questions, account lookups, and password resets took up support agents' time.
Approach: Designed and launched an assistant that answers FAQs and handles account lookup and identity validation before password resets.
Outcome: In production, resolving routine requests without a support agent.
Spring AI, Azure OpenAI, LangChain4j, Java, LLM
AegisAI, a GenAI platform for banking operations
Own time · open source
A multi-tenant GenAI platform on Spring AI: a compliance copilot that answers only from internal documents with citations, dispute agents with human approval, an OAuth2-secured MCP server, and guardrails on every model call.
Problem: Bank staff can't paste policies and statements into a model that may invent answers or leak them.
Approach: Built a copilot that cites its sources, Kafka-triggered agents that draft dispute resolutions for a human to approve, and a guardrail pipeline for PII, prompt injection, and output validation.
Outcome: Open source; a sovereign mode runs fully local with zero data egress.
Spring AI, MCP, Agents, RAG, pgvector, Guardrails
View source
Kairo, an offline-first AI bank
Own time · open source
A mobile banking app whose assistant runs on the phone. Qwen answers questions about your accounts, finds transactions by meaning, flags odd charges, and plans bills, with nothing sent to a server.
Problem: Banking assistants send transaction history to a cloud model; the privacy cost is the whole ledger.
Approach: Ran a small LLM on the phone with local vector search over transactions, so coaching, anomaly detection, and planning work with no network at all.
Outcome: Open source; every feature works in airplane mode.
React Native, Qwen, On-device LLM, Vector search, SQLite
View source
VoxOs, a voice agent for the Mac
Own time · open source · GPL-3.0
A macOS menu-bar app in Swift that turns speech into text and actions: dictation into any field, shell commands, and app control, all transcribed on the Mac. macOS 14.4 and up, GPL-3.0.
Problem: Dictation on the Mac stops at text; turning speech into actions meant leaving the keyboard for the mouse.
Approach: Built a menu-bar agent in Swift that transcribes on-device and maps phrases to shell commands, app focus, and dictation into the active cursor.
Outcome: Open source under GPL-3.0 and in daily use; audio never leaves the machine.
Swift, macOS, On-device speech, Agents
View source
What I build
Backend systems
Spring Boot services that move real money: APIs, domain rules, concurrency, and the failure handling around them.
Stack: Java 21, Spring Boot, Spring Data JPA, JUnit, Mockito
Event-driven platforms
Kafka estates where one slow consumer never stalls a payment.
Stack: Apache Kafka, NATS JetStream, Redis, PostgreSQL, Circuit breakers, Idempotency
Security and payments
Issuer-side card tokenisation, virtual cards in Google Pay and Apple Pay, maker-checker approval, TOTP, and token security.
Stack: Spring Security, OAuth2, JWT / JWE / JWS, TOTP, Visa · Mastercard, Google Pay · Apple Pay
Delivery and operations
Containerised, shipped often, and observable: Jenkins, Kubernetes, and the ELK stack.
Stack: AWS, Docker, Kubernetes, Jenkins, ELK · Prometheus · Grafana
AI, the next chapter
The same production standards applied to models: assistants that check who is asking before they answer, and AI that runs on the device so the data stays there.
Stack: Spring AI, Azure OpenAI, LangChain4j, On-device LLMs, RAG, Qwen