SSO Portal

• Spearheaded the architecture and development of the SSO portal's Keycloak-based OIDC middleware, consolidating authentication across multiple digital banking channels and enhancing security for 100+ users
• Hardened authentication endpoints with rate-limiting, configurable account lockout, device fingerprinting, and cryptographic request-signing, resulting in zero security incidents since launch
• Built a centralized middleware layer spanning 4 core capabilities (route guards, error-code normalization, session-refresh, and logging) as the integration point between front-end channels and backend services
• Architected the front-end on Next.js with a shared Radix/Tailwind component system and Zustand state management, consuming backend services via REST and GraphQL, covering 3 distinct surfaces: the authenticated portal, an admin dashboard, and public-facing pages
• Owned CI/CD and Docker-based deployment on Kubernetes, including release versioning, ongoing dependency vulnerability remediation, and a zero-downtime pipeline

Web Manager

• Sole front-end engineer for an internal operations console, owning architecture, design system, and delivery end-to-end across 7 operational domains: access control, secure credentials, file-transfer monitoring, regulatory reporting, virtual accounts, notifications, and system configuration
• Designed a dynamically generated, route- and action-level permission system covering 6 custom roles across 15+ menus and 12+ routes, each with granular action-level permissions (view, create, update, delete, export, upload, approve), computed server-side at login, cached in session, and enforced client-side without hardcoded per-page authorization checks
• Built a defense-in-depth, Redis-backed session layer (Next.js middleware + NextAuth/JWT) for a tightly-scoped internal team (1-5 daily active users) monitoring payment, payroll, and other dynamically configurable processes, using a 30-minute Redis-backed session TTL with a 35-minute front-end buffer to avoid premature client-side expiry. Each session is revalidated against the backend Redis store and terminated the moment its Redis entry disappears, catching revoked sessions a client-side token alone would miss
• Centralized API communication (REST and GraphQL) for 5+ backend services through a single client layer, normalizing inconsistent response/error contracts (including RFC 7807 problem details) and toast notifications, and reducing per-feature error-handling code

Skills