Senior Software Engineer
Infrastructure × Backend × LLM Systems
Building observable, scalable, fault-tolerant systems for mass audience.
Explore Experience
Feel free to Ask Poimen more abt it
Poimen (Ποιμήν)
Architect / Agentic Engineer
Poimen ("shepherd" in Greek) — a self-learning agent platform with two pillars: 🧠 Memory: Rust-based Graph-RAG service. Fixed-window chunking → TEI embeddings → pgvector + bidirectional graph index. Three-tier retrieval via RRF fusion: signature match (50ms), graph-boosted hybrid search, Obsidian fallback. Self-compacting cache evicts stale embeddings and auto-reconciles the graph on every write. ⚡ Workflows: Go + Temporal durable execution engine. LLM router generates WorkflowSpecs from natural language, informed by an Activity Knowledge Base (9 activities with timeout/retry/dependency metadata). JSONPath parameter chaining, catch-block recovery, exactly-once guarantees. Goal-driven: describe intent → platform assembles, executes, and self-heals.
riotpiao.com
DevOps / SRE / SDE
Designed and operate a production-grade bare-metal Kubernetes platform from scratch — 4 nodes, 3 control planes, 20+ services, 99.2% uptime. 🏗️ Infrastructure: Talos Linux immutable OS, etcd distributed consensus, Longhorn block storage, MinIO S3, CloudNativePG with pgvector. Resolved etcd leader election failures caused by 200ms network latency — re-architected the physical topology for sub-5ms RTT. 🔄 GitOps & CI/CD: Evolved from pure Terraform to Terraform (node provisioning) + ArgoCD (application delivery). Kustomize overlays, SOPS-encrypted secrets, Forgejo CI with DinD runners. Zero manual deployments — every change is a git commit. 🔐 Security & Identity: Authentik OIDC SSO + RBAC across all services. Cloudflare Tunnel zero-trust ingress, cert-manager auto-TLS, no exposed ports. 📊 Observability: Prometheus + Grafana + Loki + Tempo — full metrics, logs, traces, and alerting stack. 🤖 AI/ML Serving: vLLM GPU inference (Qwen3-32B), KServe model orchestration, TEI embeddings, Ollama lightweight models.
RBC
Lead Software Engineer
Led infrastructure platform engineering for multi-cloud IaC across 12 teams. 🏗️ State Migration: Migrated 500+ Terraform resource state files from S3 to JFrog Artifactory. Split plan/apply into immutable artifact pipeline with throttled parallelism — eliminated 503 timeouts, lock contention, and zero state corruption post-migration. 🔍 Drift Detection: Built nightly cron-based drift detection with Slack alerting — cut configuration drift visibility from 3 weeks → <24 hours. Stopped engineers hotfixing in cloud console without updating code. ⚡ Workflow Orchestration: Introduced Temporal for durable workflow execution across provisioning pipelines. Standardized IaC patterns across teams — 3× integration velocity. Stack: Terraform, OpenShift, Docker, Golang, Grafana, Artifactory, Temporal
AWS
Senior Software Engineer (Step Functions)
Owned Distributed-Map end-to-end for AWS Step Functions — 57+ regions, sub-100ms P99 latency. 🚀 Feature Ownership: Launched Redrive Execution — retry-from-failure-point for distributed workflows. Designed JSON state input for larger payloads, unlocking new customer use cases. Caught a breaking condition field change in code review — coordinated simultaneous frontend + backend deployment to prevent customer impact. 📊 Operational Excellence: Built CloudWatch dashboards, authored runbooks, owned oncall rotation. Maintained backward compatibility across frontend/backend release cycles. 🔧 Distributed Systems: DynamoDB partition design, gRPC service mesh, disaster recovery planning, multi-region replication. Stack: Java, AWS, DynamoDB, CloudWatch, gRPC, Step Functions
Titus
Software Engineer Intern
Data classification security startup — built detection and connector systems. 🔍 Anomaly Detection: Built Personal Data Detection pipeline to flag classified data exfiltration — 97.8% accuracy. ⚡ Connector: Fault-tolerant Golang data connector — 28% P99 improvement over legacy system. 🔧 Build System: Re-integrated SmartRegex engine with CMake + C++ on Linux/Unix — 5× faster deployment. Stack: Golang, C++, CMake, Docker, Linux
NAV Canada
Summer Student
Air traffic control software — enterprise web applications for flight planning and weather briefing. ✈️ FWGS Weather Briefing: Built ReactJS weather briefing interface used by air traffic controllers for real-time flight weather data. 🗳️ NOTAMJ Polls: Developed Django polling application to meet sprint iteration goals within Agile workflow. 📊 Quality: Improved deploy stability with SonarQube code coverage integration on enterprise CFPS platform. Stack: ReactJS, Django, SonarQube, Agile
What have i Built and Building
Demonstrate my work
Poimen: Agent Workflow Orchestration
Poimen (Greek: Ποιμήν) means "shepherd" — a guide who tends, orchestrates, and reconciles. Poimen is an intelligent orchestration layer that transforms natural language into durable, distributed agent workflows powered by Temporal.
An LLM router analyzes user intent, retrieves relevant knowledge from semantic memory, and generates executable workflow specs — enabling agent deployment at scale where any activity can be wired as a composable step in the reconciliation pipeline. Every workflow is durable, retryable, and observable.
- •LLM-Powered Workflow Routing: Natural language → executable WorkflowSpec via reasoning model (api.riotpiao.com). Activity Knowledge Base (9 activities) informs the LLM about timeouts, retry policies, and dependencies—intelligent step ordering and error handling strategies.
- •Memory-Augmented Context Retrieval: RetrieveMemoryActivity queries poimen-memory (Rust semantic search service) for relevant skills and lessons before routing—injecting domain knowledge into prompts for context-aware workflow generation.
- •Generic State Machine Executor: RoutingWorkflow executes any JSON workflow spec with JSONPath parameter chaining (${Step1.output.path}), automatic retries for flaky activities, catch blocks for error recovery, and Temporal's durable execution guarantees—every registered activity a composable building block.
📊 Temporal, LLM Routing, 9 Composable Activities
📊 Natural language → executable WorkflowSpec via reasoning model + memory-augmented context retrieval + durable state machine execution.
Poimen Memory System
The memory layer behind Poimen — a distributed Graph-RAG system that gives the shepherd long-term recall, semantic search, and hierarchical access control over its knowledge base.
Three-tier context retrieval pipeline with PageRank-style link scoring, hybrid search fusion (HNSW + BM25), and OIDC-based access control for multi-tenant knowledge graphs.
- •Graph-RAG with Wiki-Link Indexing (Rust, pgvector, OpenSearch): Built bidirectional link graph from [[wiki-link]] syntax during ingestion. PageRank-style score propagation boosts linked documents' relevance. RRF fusion merges HNSW cosine (pgvector) + BM25 lexical (OpenSearch). WikiScopedFilter constrains traversal to project boundaries.
- •Three-Tier Context Retrieval (Actix-web, tokio): Async pipeline — Tier 1: MD5 signature match (<50ms), Tier 2: graph-boosted hybrid search with link-distance decay, Tier 3: Obsidian API fallback. Budget-aware assembly drops lower tiers first. Shingle-based Jaccard deduplication (>0.5) prevents redundant chunks.
- •Hierarchical RBAC (Authentik OIDC, JWT, Kubernetes): Role → AccessRule[] → AccessScope model with project/visibility/owner/group constraints. JWT roles claim maps to YAML rules; AccessGuard.filter_resources() applies post-retrieval filtering. Dual-write indexer (eventual consistency via queue) maintains RBAC-aware views. SOPS/age encryption, ArgoCD deployment.
📊 Graph-RAG, pgvector, OpenSearch, Rust + Actix-web
📊 Bidirectional wiki-link indexing with RRF fusion + hierarchical RBAC — 50ms signature match tier, graph-boosted hybrid search tier, Obsidian fallback.
Homelab: Production-Grade Kubernetes Platform
From bare metal to a self-healing, GitOps-driven platform — 4-node cluster running 20+ services with full observability, zero-trust networking, and GPU-accelerated AI inference.
Built and operate a production-grade Kubernetes platform on Talos Linux — self-healing nodes, declarative GitOps deployments via ArgoCD, SOPS-encrypted secrets, OIDC single sign-on, and end-to-end observability (Prometheus → Grafana → Loki → Tempo). Every change is auditable, every failure auto-recovers, every service is monitored.
- •Talos Linux bare-metal cluster — immutable OS, API-driven node management, self-healing on failure
- •ArgoCD + Kustomize + SOPS — zero-touch GitOps: every deploy is a git commit, every secret is encrypted
- •Authentik OIDC SSO + RBAC — single identity across 20+ services, zero-trust access from day one
- •Prometheus + Grafana + Loki + Tempo — full observability stack: metrics, logs, traces, alerts
- •vLLM GPU inference (Qwen3-32B) + KServe — production AI serving with autoscale and traffic splitting
- •Temporal + Kafka + CloudNativePG — durable workflows, event streaming, HA PostgreSQL with pgvector
- •Cloudflare Tunnel + cert-manager — zero-trust ingress, auto-TLS, no exposed ports
📊 4 nodes · 20+ services · 99.2% uptime · 0 manual deployments
📊 Production-grade platform engineering — not a hobby cluster. Self-healing infrastructure, GitOps-only deployments, full-stack observability, and GPU inference at home.
RBC: Multi-Cloud Platform
Unified infrastructure platform consolidating public cloud and on-prem.
Terraform automation with Temporal orchestration. 99.2% automated provisioning, notification-driven operator fallback.
- •Integrated Terraform Cloud to centralize IaC workflows—reduced onboarding time for 12 teams
- •Built K8s CronJob to detect and reconcile Terraform state drift automatically (Golang)
- •Designed Slack notification service with Golang workers—operators resolve apply failures in <5min
- •Led requirement gathering across 4 platform teams—disambiguated specs, unblocked 3 stalled projects
- •Translated technical decisions for non-technical stakeholders—secured buy-in for platform migration
📊 200+ microservices, 4 regions, 2hr→20min deploy
📊 Standardized IaC patterns across 12 teams—cut provisioning toil, 3x integration velocity.
AWS Distributed-Map
Launched distributed task orchestration service for mission-critical workloads.
Optimized execution across 57+ regions with fault-tolerant scheduling and auto-scaling.
- •Under tight deadline, introduced separate state in Map vs new functions—simplified customer adoption (Java)
- •Built checkpoint recovery for mid-workflow failures—customers resume without full re-run
- •Solved distributed edge cases: race conditions, concurrent updates, dependent service failures, message deduplication
- •Owned oncall for the service—built CloudWatch dashboards, wrote runbooks, debugged production live
📊 57+ regions, sub-100ms P99, 20x burst traffic
📊 Introduced JSON state input for larger payloads—unlocked new customer use cases.