What I actually do
I am a hands-on principal engineer and enterprise architect. I own systems end-to-end: the security model, the data path, the developer experience, the observability, and the ADR that explains why it is shaped that way. I am equally comfortable in a Java 21 hot path, an OPA/Rego policy, a Python SQL-rewriting firewall, and a React dashboard.
The through-line of my career is deciding who gets to see what: identity and access (OIDC/OAuth2 SSO for 4M+ customers across Walmart International; today an XACML-style authorization platform for HR data), governed data access (row-, column- and attribute-level security enforced at query time), and governed AI — exposing certified data and tools to agents through MCP servers, 43 tools across two platforms, without loosening a single access control.
How I work
Specification first. Before code there is a written decision: the problem, the options, the trade-offs, the choice. Across Sage and AccessIntel that has become 90+ architecture decision records, and it is the reason a one-person team can move at the pace of a five-person one.
AI-augmented, human-accountable. I direct a small orchestra of coding agents — Claude Code, Codex, Copilot and friends — and I review everything they produce. The agents write faster than I do; I still decide what gets built, how it is secured, and whether it ships.
Boring technology, deliberately. Spring Boot, PostgreSQL, React, Kubernetes, plain CSS. Novelty goes into the problem being solved, not into the toolchain. When something new earns its place (Virtual Threads, MCP, LangGraph) it gets adopted with a written rationale, not a hunch.
Production is the point. SLIs and SLOs, golden-signal dashboards, change governance, a weekly Cloud Cost Council that cut cloud run rate by 12–20% (roughly $100K a year) — I chaired the councils that made 20+ services boring to operate, and I like it that way.
What I care about
Security that is structural rather than aspirational: a five-layer model where every query is parsed into an AST and rewritten for the viewer before it touches data. When a HackerOne bounty landed 23 findings on my desk with a three-week SLA, the fix was not 23 patches — it was a re-architected JWT model and an 882-assertion regression suite that still gates CI.
Teaching and tools for learners. Outside work I build small educational products for kids and students — Hindi and English learning sites, quiz apps for exam preparation — mostly because my own family needed them, and because a small useful thing shipped beats a big impressive thing planned.
Writing it down. Whitepapers on Java 21 patterns, privacy-compliance adapters and single-identity architecture; ADRs; a blog. If it isn’t written, it isn’t shared.
Beyond the keyboard
I hold an MBA (2017) alongside a BCA (2003), which mostly means I can argue about unit economics and thread pools in the same meeting. I have been an entrepreneur (Techworks, Kolkata, 2009–2014), an Associate Director, a Principal Solution Architect and a Principal Software Engineer — and I have never quite stopped being the first of those.
Currently in Bengaluru, currently learning whatever the next thing turns out to be.