Mizanur Rahman Ashiq

Melbourne, Australia · Remote

• Technical lead on RenoSafe, a multi-tenant construction-finance platform (Django 5, DRF, Vue 3, PostgreSQL, Keycloak, Stripe, AWS EKS): led a five-engineer team on a greenfield build (27K lines of backend, 45K of frontend, 1,200+ automated tests), serving as release gatekeeper and authoring the architecture decision specs.
• Hardened PostgreSQL row-level security to fail closed, closing a class of cross-tenant data leaks the test suite could not catch - split database roles so the app runs as a non-superuser, added a readiness probe that blocks traffic when isolation is off, and fixed tenant-context gaps on webhooks, provisioning, and admin cross-firm reads.
• Delivered the payment and escrow rails single-handedly: a full Stripe subscription lifecycle (idempotent payment intents, webhook activation, abandoned-checkout void, reconciler) and a double-entry escrow ledger with invariant checks and hold/release/refund flows.
• Removed dashboard and list-view N+1 queries with batched, owner-scoped read paths, locked the gains in with query-count regression tests, and resolved production incidents from unbounded feeds, missing upstream timeouts, and a connection leak.
• Set the team's standards for row-level security, migrations, review, and deployment, and built AI review agents that enforce them on every pull request.
• Built MarketBridge (sole engineer), a FastAPI + React 19 backend-for-frontend unifying a billing and a marketing-automation platform behind one typed contract; and Cortex's AWS Bedrock model-routing tier, which keeps roughly three-quarters of traffic off the most expensive model.

Dhaka, Bangladesh · Hybrid

• Designed and shipped the versioned public REST API (v4) across 116 business entities and roughly 370 endpoints for Exsited/AutoBill - the shared framework other teams built on: signed cursor pagination, Redis-backed idempotency keys, 139 typed request objects, optimistic concurrency, and a 23-code error envelope.
• Built a reusable filtering, sorting, and field-projection layer (13 operators with per-type validation, bounded text search, response masking) adopted unchanged by 24 list endpoints with zero per-module configuration.
• Cut list-endpoint database load by an order of magnitude, from 102 to 5 SQL statements per page on the notes API, by replacing per-row lookups with batched foreign-key loaders across roughly 20 endpoints.
• Sole author of the OData v4 analytics feed (Apache Olingo, 19 entities) that let customers query their billing data from Power BI, including a filter-expression translator with 11 operators and 13 functions.
• Largest contributor to an 893-permission access-control model - added permission groups, closed URL-level authorization holes, and gated every API write behind an explicit permission and licence check.
• Built the batch billing operations centre (invoice runs, payment runs, dunning, direct-debit files) and made bulk CSV import/export observable across 13 entities, both with execution history, per-row failure tracking, and live progress; mentored 2 engineers to independent delivery.