# Dawit Bayou Kassie, Solutions Architect & Full-Stack Engineer

Dawit Bayou Kassie is a software engineer and solutions architect based in Addis Ababa, Ethiopia. He designs, builds and runs identity, records, access and ERP systems on NestJS, TypeScript and PostgreSQL, and is open to senior engineering, architecture and technical lead roles in Addis Ababa or remote.

I design, build and run the systems a company depends on, such as identity, records, access and ERP, from the first requirement to a supported live service. I leave behind the tests, runbooks and decision records that let someone else run them.

## At a glance
- Based in: Addis Ababa, Ethiopia
- Focus: Identity, ERP and business systems, multi-tenant SaaS, internal platforms
- Stack: NestJS, TypeScript, PostgreSQL, Next.js, Docker
- Open to: Senior engineering, architecture and technical lead roles. Addis Ababa or remote.
- Languages: English (fluent) and Amharic (native)
- Email: dawitbk01@gmail.com
- GitHub: https://github.com/DawitBK
- LinkedIn: https://www.linkedin.com/in/dawit-b-kassie

## In numbers
- 3,000+ automated tests across three enterprise systems
- 3 enterprise platforms, from requirements to release
- 4 open-source applications on one shared stack
- 3+ years shipping production systems

## What I do
### Architecture and system design
I settle service boundaries, data models, tenancy and failure modes before code, and record each choice as an architecture decision with the options I rejected. Anything touching identity, money or personal data gets a threat model and a design review.

### Backend engineering
NestJS and Node.js services on PostgreSQL, with OpenAPI contracts, reviewed migrations, rotating refresh tokens and idempotent writes. Rules that must never break live in the database as constraints and triggers. Queues and WebSockets where the workload needs them.

### Frontend and UI/UX
Next.js and React interfaces built on the same typed contracts as the API, with clear loading, empty and error states, tested end to end in real browsers. I design flows and screens in Figma first, and use Illustrator, Photoshop and Premiere Pro for brand and media assets.

### ERP and business systems
Custom ERP builds and ERP customisation on Odoo and ERPNext: modules, workflows, approvals, integrations, single sign-on and reports. I built Retail OS (point of sale, inventory, double-entry accounting) and customised Odoo 20 into a manufacturing-operations ERP with 42 custom addons and more than 500 tests, from the specification to OpenID Connect sign-in.

### Identity and security engineering
A custom OpenID Connect provider with PKCE, signed tokens and Active Directory integration. Role-based access, tenant isolation in the database, hash-chained audit logs, AES-256-GCM at rest, back-channel logout and signed releases, designed in and not added later.

### Applied AI
LLM integration with tenant-scoped tool calling, document summaries and metadata extraction, and policy controls on what a model may see and do. I design retrieval-augmented search on pgvector and full-text search, and agentic features where only a person approves outcomes. I direct AI coding agents under evidence-based review.

### DevOps and release engineering
Git branching and review workflows, CI/CD on GitHub Actions and GitLab, Docker, Kubernetes, Terraform, AWS and Azure, with Nginx or Apache in front and monitoring behind. Releases are signed, preflight-checked and backed up first, with automatic rollback.

### Quality engineering
Every stated guarantee has a test named for it: unit, integration against real PostgreSQL, and end-to-end in real browsers, enforced in CI before anything ships. Independent code reviews follow, and I fix what they find. Three employer systems carry over 3,000 tests between them.

### Technical leadership
I work as part of a team and help build one: I write the BRD, FRS and TDD, report to executives, and train the people who operate the result. I direct engineers and AI coding agents, set the review standard, mentor teammates and learn from them, and keep decisions in writing so a team can carry on without me.

## Enterprise platforms (employer systems, private source)
### Identity platform
Every internal system used to have its own login. I replaced them with one custom OpenID Connect provider on the company's existing Active Directory.
- Authorization code with PKCE, signed tokens, an admin console and an application launcher for every connected system.
- The hard part is signing out: when someone signs out, leaves or is deactivated, a signed back-channel notice reaches every connected app and ends their sessions there, not only in the portal.
- Licences are signed offline and verified without calling home, and a system tied to single sign-on stops when single sign-on does.
- 834 automated tests
- Back-channel logout
- Offline-signed licences
- Signed releases, tamper watcher
- Built with: Node.js, Express, TypeScript, PostgreSQL, Next.js, OpenID Connect

### Document and records platform
An archive staff can search, govern and question, with every access rule and every change on record.
- The full records lifecycle: capture, approval, e-signatures, retention schedules and legal hold, with full-text search across the archive.
- An opt-in AI assistant answers questions over documents and audit logs, summarises documents and extracts metadata, behind per-tenant consent and usage controls.
- Fifty-three permissions across seven roles with per-document access rules; audit logs are hash-chained so an edit shows, and files are encrypted at rest with AES-256-GCM.
- 1,639 automated tests
- 53 permissions, 7 roles
- Hash-chained audit
- Legal hold and retention
- Built with: Node.js, Express, TypeScript, Next.js, PostgreSQL, MinIO, Redis, BullMQ, Meilisearch

### Guest management platform
Visitors, approvals and door access across several offices, live on the company's own server.
- Seven roles and an approval and escalation workflow, with credentials delivered to the visitor in real time over WebSockets.
- Door-access hardware, one-time-code sign-in, QR and PIN credentials, and ID scanning with watchlist screening at reception.
- Taken through QA and UAT to a live deployment behind an Apache reverse proxy, and I trained the IT staff who operate it.
- 605 automated tests
- 7 roles
- Real-time WebSockets
- IT staff trained
- Built with: Node.js, Express, TypeScript, Next.js, PostgreSQL, Redis, BullMQ, WebSockets, Docker

### Release and licensing security
A repeatable, verifiable way to ship the platform to a server that only a few people may touch.
- Every release runs preflight checks first. Settings change only at apply time, with a backup taken beforehand and automatic rollback if anything fails.
- Releases are signed and a tamper watcher reports changes. Owner-only operations stay outside any automated agent's permissions.
- Every change is rehearsed in a production-like environment first, and independent reviews of my own work are fixed before release.
- Rehearsed, with rollback
- Signed releases
- Tamper watcher
- Preflight checks
- Built with: Node.js, PowerShell, Cryptographic signing

## Open-source reference applications
Four applications on one stack that show the same discipline in public. Retail OS enforces double-entry accounting with a deferred database trigger. JobPilot isolates tenants with row-level security and submits no job application until a person approves it. All four use OpenID Connect sign-in.

### [Retail OS](https://github.com/DawitBK/retail-os)
A point of sale where the shelf and the books cannot disagree.
- Every journal entry balances: the application checks it, and a deferred database trigger checks it again at commit.
- Posted history is append-only in the database itself; a void is the only change allowed, so a hand-typed UPDATE cannot rewrite the books.
- Two tills cannot sell the last unit twice or push a customer past a credit limit, and money is integer minor units, never a float. Sales analytics, forecasts and a cash-flow statement sit on top.
- Built with: NestJS 12, Drizzle, PostgreSQL 18, Next.js 16

### [JobPilot](https://github.com/DawitBK/jobpilot)
Job search where the software proposes and only a person approves.
- Tenant isolation is the database's job: with row-level security, a session that names no tenant sees nothing.
- Applications move through an 18-state machine, and a database constraint refuses an approval recorded by the AI or the browser worker.
- AI-drafted documents are checked sentence by sentence against the candidate's record, and anything flagged stops for a person. The audit trail is hash-chained.
- Built with: NestJS 12, Drizzle, PostgreSQL 18, Row-level security

### [Martronics](https://github.com/DawitBK/martronics)
An electronics store with a catalogue, cart and checkout, built as enterprise-grade services.
- Rotating refresh tokens with reuse detection, and optimistic concurrency on every write.
- Checkout is idempotent, so a retried request never places an order twice, and events leave through a transactional outbox.
- An OpenAPI contract, and sign-in through OpenID Connect with back-channel logout.
- Built with: NestJS 12, Drizzle, PostgreSQL 18, Next.js 16

### [Library Management](https://github.com/DawitBK/library-management-system)
A public catalogue and a staff circulation desk.
- Holds are queued fairly: a returned copy goes to the member who has waited longest.
- Overdue loans accrue fines, and unpaid fines above a limit block further borrowing.
- Idempotent lending, optimistic concurrency, an OpenAPI contract and OpenID Connect sign-in with back-channel logout.
- Built with: NestJS 12, Drizzle, PostgreSQL 18, Next.js 16

## Experience
### Solutions Architect & Full Stack Engineer, A multi-sector conglomerate (2026 to present, Addis Ababa, on-site)
- Lead architecture and delivery for four internal platforms (identity, records, visitors and retail ERP), directing engineers and AI coding agents.
- Built the single sign-on provider as a custom OpenID Connect service: authorization code with PKCE, signed tokens, Active Directory integration, an admin console, an application launcher, and back-channel logout that ends a person's sessions in every connected system when they sign out or their account is deactivated.
- Designed licensing and release security for the platform: offline-signed licences that systems verify without calling home, signed releases, a tamper watcher, and owner-only operations kept out of any agent's permissions.
- Own the full lifecycle: requirements, design, build, verification, release and operator training, with preflight checks, signed releases and automatic rollback.
- Built three of the platforms to a tested standard (834, 1,639 and 605 automated tests) and introduced independent code reviews, with every finding fixed. After catching AI agents reporting work that never happened, every task requires live request and response or SQL output as proof.
- Took the guest platform through QA and UAT to a live deployment on the company's own server, and trained the IT staff who run it.
- Write the requirements (BRD, FRS), technical design documents, executive reports and training material.

### Web Developer, Edge Communication Technologies P.L.C (Sep to Oct 2025, Addis Ababa, on-site)
- Built and maintained responsive corporate platforms and internal business applications for public-facing and operational use.
- Improved frontend consistency, the deployment workflow and page load times by standardising the component architecture.
- Scoped requirements with technical and operational teams and delivered production-ready systems on tight timelines.

### Full Stack, Cloud & DevOps Engineer, Freelance (Jan 2023 to 2025, Remote)
- Designed, built and deployed full-stack applications for clients in several industries (MERN and PERN), from scoping to production launch.
- Built backend APIs, authentication and database schemas around each client's real read and write patterns.
- Set up container and CI/CD pipelines with Docker and GitHub Actions, and managed AWS and Azure deployments including networking, storage, compute and IAM.

## Skills
- Backend: TypeScript, Node.js, NestJS, Express, OpenAPI, WebSockets, Kafka, RabbitMQ; working knowledge of Python and Java
- Frontend and UI/UX: React, Next.js, TypeScript, UI/UX design, Figma, Adobe Illustrator, Photoshop, Premiere Pro
- ERP and business systems: Odoo (custom addons, OpenID Connect integration), ERPNext customisation, custom ERP design, inventory, double-entry accounting, manufacturing operations, approval workflows, reports
- Data: PostgreSQL (row-level security, triggers, migrations), pgvector, Redis, MongoDB, Meilisearch, Drizzle, Prisma
- DevOps and delivery: Git workflows, CI/CD with GitHub Actions and GitLab, Docker, Kubernetes, Terraform, AWS, Azure, Nginx, Apache, Linux, Windows Server, monitoring
- Identity and security: OpenID Connect, OAuth 2.0, PKCE, Active Directory, RBAC, JWT, AES-256-GCM, OWASP practice
- Architecture: Multi-tenant SaaS, event-driven design, transactional outbox, Domain-Driven and Clean Architecture, decision records, threat modelling
- Applied AI: LLM integration, retrieval-augmented search, agentic systems, policy controls, AI-assisted development with evidence-based review

## Education
- BSc, Electrical & Computer Engineering, Addis Ababa Institute of Technology, 2022
- Full Stack & DevOps Engineer Certification, Addis Ababa University, 2025