Skip to content

Solutions Architect & Full-Stack Engineer

Dawit Bayou Kassie, Solutions Architect & Full-Stack Engineer in Addis Ababa, Ethiopia. Systems whoseguarantees can bechecked.

I design, build and run the systems a company depends on, such as identity, records, access and ERP, from the first requirement to a supported live service. I leave behind the tests, runbooks and decision records that let someone else run them.

See the workOpen the live demosDownload resume
guarantees
IdentityOpenID Connect, PKCEBack-channel logoutDocumentsGuestsRetail OSJobPilotMartronicsLibraryPostgreSQLRow-level securityTriggersHash-chained audit
From the projects below. 3,000+ tests across the three employer systems.
3,000+

automated tests across three enterprise systems

834 + 1,639 + 605

3

enterprise platforms, from requirements to release

4

open-source applications on one shared stack

3+

years shipping production systems

What I do

One engineer across the whole system.

My value is in the joins: requirement to design, design to code, code to operations, and engineers to the people who use what they build. I work as part of a team: I help build one, train it, and learn from it.

Explore by area

Explore by area. Showing 9 of 9

  • 01

    Architecture and system design

    I settle service boundaries, data models, tenancy and failure modes before code, and record each choice as an architecture decision with the options I rejected. Anything touching identity, money or personal data gets a threat model and a design review.

    • Service boundaries
    • Data models
    • Decision records
    • Threat models
  • 02

    Backend engineering

    NestJS and Node.js services on PostgreSQL, with OpenAPI contracts, reviewed migrations, rotating refresh tokens and idempotent writes. Rules that must never break live in the database as constraints and triggers. Queues and WebSockets where the workload needs them.

    • NestJS
    • PostgreSQL
    • OpenAPI
    • Idempotent writes
  • 03

    Frontend and UI/UX

    Next.js and React interfaces built on the same typed contracts as the API, with clear loading, empty and error states, tested end to end in real browsers. I design flows and screens in Figma first, and use Illustrator, Photoshop and Premiere Pro for brand and media assets.

    • Next.js
    • React
    • Figma
    • End-to-end tests
  • 04

    ERP and business systems

    Custom ERP builds and ERP customisation on Odoo and ERPNext: modules, workflows, approvals, integrations, single sign-on and reports. I built Retail OS (point of sale, inventory, double-entry accounting) and customised Odoo 20 into a manufacturing-operations ERP with 42 custom addons and more than 500 tests, from the specification to OpenID Connect sign-in.

    • Odoo
    • ERPNext
    • Double-entry accounting
    • OpenID Connect
  • 05

    Identity and security engineering

    A custom OpenID Connect provider with PKCE, signed tokens and Active Directory integration. Role-based access, tenant isolation in the database, hash-chained audit logs, AES-256-GCM at rest, back-channel logout and signed releases, designed in and not added later.

    • OpenID Connect
    • PKCE
    • Active Directory
    • AES-256-GCM
  • 06

    Applied AI

    LLM integration with tenant-scoped tool calling, document summaries and metadata extraction, and policy controls on what a model may see and do. I design retrieval-augmented search on pgvector and full-text search, and agentic features where only a person approves outcomes. I direct AI coding agents under evidence-based review.

    • pgvector
    • Full-text search
    • Tool calling
    • Policy controls
  • 07

    DevOps and release engineering

    Git branching and review workflows, CI/CD on GitHub Actions and GitLab, Docker, Kubernetes, Terraform, AWS and Azure, with Nginx or Apache in front and monitoring behind. Releases are signed, preflight-checked and backed up first, with automatic rollback.

    • GitHub Actions
    • Docker
    • Kubernetes
    • Terraform
  • 08

    Quality engineering

    Every stated guarantee has a test named for it: unit, integration against real PostgreSQL, and end-to-end in real browsers, enforced in CI before anything ships. Independent code reviews follow, and I fix what they find. Three employer systems carry over 3,000 tests between them.

    • Unit
    • Integration
    • End-to-end
    • 3,000+ tests
  • 09

    Technical leadership

    I work as part of a team and help build one: I write the BRD, FRS and TDD, report to executives, and train the people who operate the result. I direct engineers and AI coding agents, set the review standard, mentor teammates and learn from them, and keep decisions in writing so a team can carry on without me.

    • BRD, FRS, TDD
    • Executive reports
    • Team building
    • Training
    • Code review

How I deliver

A lifecycle I run the same way every time.

Seven stages, each with an artefact I produce. Security is a property of the design at every stage, not a review at the end.

Stage 01 of 07

Requirements

I turn stakeholder needs into a business requirements document (BRD) and a functional requirements specification (FRS). Every requirement gets an acceptance criterion that can be tested. Abuse and failure cases are written beside the user stories, and open questions are listed with an owner before any build starts.

Produces

  • BRD
  • FRS
  • acceptance criteria

Security by design

Six properties I design for from the first diagram, and check again before release.

  • Identity

    OpenID Connect with PKCE, signed tokens, central sign-out and least-privilege roles

  • Isolation

    Tenant separation enforced by the database, not by convention

  • Integrity

    Hash-chained audit logs, signed releases and a tamper watcher that reports changes

  • Confidentiality

    AES-256-GCM at rest, TLS in transit, secrets kept out of source

  • Resilience

    Rate limiting, backups with tested restores, and automatic release rollback

  • Assurance

    OWASP practice, dependency audit gates, threat models and independent review

Selected work

Systems built to this standard.

Three enterprise platforms I built for an employer, the release security behind them, and four applications I publish in the open.

  • Employer system, private

    Identity platform

    834 automated tests

    Every internal system used to have its own login. I replaced them with one custom OpenID Connect provider on the company's existing Active Directory.

    • Authorization code with PKCE, signed tokens, an admin console and an application launcher for every connected system.
    • The hard part is signing out: when someone signs out, leaves or is deactivated, a signed back-channel notice reaches every connected app and ends their sessions there, not only in the portal.
    • Licences are signed offline and verified without calling home, and a system tied to single sign-on stops when single sign-on does.
    • Back-channel logout
    • Offline-signed licences
    • Signed releases, tamper watcher

    Built with: Node.js · Express · TypeScript · PostgreSQL · Next.js · OpenID Connect

  • Employer system, private

    Document and records platform

    1,639 automated tests

    An archive staff can search, govern and question, with every access rule and every change on record.

    • The full records lifecycle: capture, approval, e-signatures, retention schedules and legal hold, with full-text search across the archive.
    • An opt-in AI assistant answers questions over documents and audit logs, summarises documents and extracts metadata, behind per-tenant consent and usage controls.
    • Fifty-three permissions across seven roles with per-document access rules; audit logs are hash-chained so an edit shows, and files are encrypted at rest with AES-256-GCM.
    • 53 permissions, 7 roles
    • Hash-chained audit
    • Legal hold and retention

    Built with: Node.js · Express · TypeScript · Next.js · PostgreSQL · MinIO · Redis · BullMQ · Meilisearch

  • Employer system, private

    Guest management platform

    605 automated tests

    Visitors, approvals and door access across several offices, live on the company's own server.

    • Seven roles and an approval and escalation workflow, with credentials delivered to the visitor in real time over WebSockets.
    • Door-access hardware, one-time-code sign-in, QR and PIN credentials, and ID scanning with watchlist screening at reception.
    • Taken through QA and UAT to a live deployment behind an Apache reverse proxy, and I trained the IT staff who operate it.
    • 7 roles
    • Real-time WebSockets
    • IT staff trained

    Built with: Node.js · Express · TypeScript · Next.js · PostgreSQL · Redis · BullMQ · WebSockets · Docker

  • Employer platform, private

    Release and licensing security

    Rehearsed, with rollback

    A repeatable, verifiable way to ship the platform to a server that only a few people may touch.

    • Every release runs preflight checks first. Settings change only at apply time, with a backup taken beforehand and automatic rollback if anything fails.
    • Releases are signed and a tamper watcher reports changes. Owner-only operations stay outside any automated agent's permissions.
    • Every change is rehearsed in a production-like environment first, and independent reviews of my own work are fixed before release.
    • Signed releases
    • Tamper watcher
    • Preflight checks

    Built with: Node.js · PowerShell · Cryptographic signing

Open source

Open-source reference applications

Four applications on one stack that show the same discipline in public. Retail OS enforces double-entry accounting with a deferred database trigger. JobPilot isolates tenants with row-level security and submits no job application until a person approves it. All four use OpenID Connect sign-in.

  • NestJS 12, Drizzle
  • PostgreSQL 18
  • Next.js 16
  • OpenAPI contracts

  • Retail OS

    A point of sale where the shelf and the books cannot disagree.

    • Every journal entry balances: the application checks it, and a deferred database trigger checks it again at commit.
    • Posted history is append-only in the database itself; a void is the only change allowed, so a hand-typed UPDATE cannot rewrite the books.
    • Two tills cannot sell the last unit twice or push a customer past a credit limit, and money is integer minor units, never a float. Sales analytics, forecasts and a cash-flow statement sit on top.

    Built with: NestJS 12 · Drizzle · PostgreSQL 18 · Next.js 16

    View on GitHub: Retail OS (opens in a new tab)

  • JobPilot

    Job search where the software proposes and only a person approves.

    • Tenant isolation is the database's job: with row-level security, a session that names no tenant sees nothing.
    • Applications move through an 18-state machine, and a database constraint refuses an approval recorded by the AI or the browser worker.
    • AI-drafted documents are checked sentence by sentence against the candidate's record, and anything flagged stops for a person. The audit trail is hash-chained.

    Built with: NestJS 12 · Drizzle · PostgreSQL 18 · Row-level security

    View on GitHub: JobPilot (opens in a new tab)

  • Martronics

    An electronics store with a catalogue, cart and checkout, built as enterprise-grade services.

    • Rotating refresh tokens with reuse detection, and optimistic concurrency on every write.
    • Checkout is idempotent, so a retried request never places an order twice, and events leave through a transactional outbox.
    • An OpenAPI contract, and sign-in through OpenID Connect with back-channel logout.

    Built with: NestJS 12 · Drizzle · PostgreSQL 18 · Next.js 16

    View on GitHub: Martronics (opens in a new tab)

  • Library Management

    A public catalogue and a staff circulation desk.

    • Holds are queued fairly: a returned copy goes to the member who has waited longest.
    • Overdue loans accrue fines, and unpaid fines above a limit block further borrowing.
    • Idempotent lending, optimistic concurrency, an OpenAPI contract and OpenID Connect sign-in with back-channel logout.

    Built with: NestJS 12 · Drizzle · PostgreSQL 18 · Next.js 16

    View on GitHub: Library Management (opens in a new tab)

Live demos

See them running.

Company-neutral editions on demo data. Start at the identity portal, which every other demo signs in through; they run on one machine of mine, so one may occasionally be offline.

Demo access

Sign in as a system administrator

One shared sandbox account opens every demo with full administrator rights, so you can see each system the way its operator does.

  1. 1Open the identity portal and sign in with the details here.
  2. 2Choose any application from the list. You are signed in to it automatically.
  3. 3Look around, change things, break things. The data is demo data.
  • Identity admin console
  • Document system: system administrator
  • Guest system: super administrator
  • Retail OS: owner
  • JobPilot: member, with its own workspace
  • Martronics and Library: administrator

Sandbox sign-in

Email

demo.admin@examplecorp.com

Password

Portfolio-Demo-2026!
Open the identity portal

This is a shared public sandbox. Please leave the password as it is. If sign-in fails, the demo is offline or being reset; try again later.

Private code, public proof

Platform showcases

The identity, document and guest platforms are private code, so each has a public showcase repository: what it does, how it is built, screenshots and the live demo. Source access is granted on request.

All demos

7 live editions on demo data

Experience

Background.

From freelance client work to leading architecture and delivery for a conglomerate.

    • Lead architecture and delivery for four internal platforms (identity, records, visitors and retail ERP), directing engineers and AI coding agents.
    • Built the single sign-on provider as a custom OpenID Connect service: authorization code with PKCE, signed tokens, Active Directory integration, an admin console, an application launcher, and back-channel logout that ends a person's sessions in every connected system when they sign out or their account is deactivated.
    • Designed licensing and release security for the platform: offline-signed licences that systems verify without calling home, signed releases, a tamper watcher, and owner-only operations kept out of any agent's permissions.
    • Own the full lifecycle: requirements, design, build, verification, release and operator training, with preflight checks, signed releases and automatic rollback.
    • Built three of the platforms to a tested standard (834, 1,639 and 605 automated tests) and introduced independent code reviews, with every finding fixed. After catching AI agents reporting work that never happened, every task requires live request and response or SQL output as proof.
    • Took the guest platform through QA and UAT to a live deployment on the company's own server, and trained the IT staff who run it.
    • Write the requirements (BRD, FRS), technical design documents, executive reports and training material.

    • Built and maintained responsive corporate platforms and internal business applications for public-facing and operational use.
    • Improved frontend consistency, the deployment workflow and page load times by standardising the component architecture.
    • Scoped requirements with technical and operational teams and delivered production-ready systems on tight timelines.

    • Designed, built and deployed full-stack applications for clients in several industries (MERN and PERN), from scoping to production launch.
    • Built backend APIs, authentication and database schemas around each client's real read and write patterns.
    • Set up container and CI/CD pipelines with Docker and GitHub Actions, and managed AWS and Azure deployments including networking, storage, compute and IAM.

Skills

Explore the toolbox.

63 skills across 8 areas

Backend09

  • TypeScript
  • Node.js
  • NestJS
  • Express
  • OpenAPI
  • WebSockets
  • Kafka
  • RabbitMQ
  • working knowledge of Python and Java

Frontend and UI/UX08

  • React
  • Next.js
  • TypeScript
  • UI/UX design
  • Figma
  • Adobe Illustrator
  • Photoshop
  • Premiere Pro

ERP and business systems08

  • Odoo(custom addons, OpenID Connect integration)
  • ERPNext customisation
  • custom ERP design
  • inventory
  • double-entry accounting
  • manufacturing operations
  • approval workflows
  • reports

Data07

  • PostgreSQL(row-level security, triggers, migrations)
  • pgvector
  • Redis
  • MongoDB
  • Meilisearch
  • Drizzle
  • Prisma

DevOps and delivery12

  • Git workflows
  • CI/CD with GitHub Actions and GitLab
  • Docker
  • Kubernetes
  • Terraform
  • AWS
  • Azure
  • Nginx
  • Apache
  • Linux
  • Windows Server
  • monitoring

Identity and security08

  • OpenID Connect
  • OAuth 2.0
  • PKCE
  • Active Directory
  • RBAC
  • JWT
  • AES-256-GCM
  • OWASP practice

Architecture06

  • Multi-tenant SaaS
  • event-driven design
  • transactional outbox
  • Domain-Driven and Clean Architecture
  • decision records
  • threat modelling

Applied AI05

  • LLM integration
  • retrieval-augmented search
  • agentic systems
  • policy controls
  • AI-assisted development with evidence-based review

Education

  • BSc, Electrical & Computer Engineering

    Addis Ababa Institute of Technology

    2022

  • Full Stack & DevOps Engineer Certification

    Addis Ababa University

    2025

  • Languages

    English (fluent) and Amharic (native)

Contact

Have a system that has to be right?Let's talk.

I am open to senior engineering, architecture and technical lead roles, in Addis Ababa or remote. Email gets the fastest reply.

Email me
Download resume