I build the whole product. And I ship it myself.

1. Jan 2026 – Present

   Senior Product & Experience Engineer

   SABAU STRAPPING · Canary Islands, remote

   I own product and AI services end to end, from the data model through to deployment on Kubernetes, plus the platform frontend. That is the formal job title; the work itself is full-stack, end to end, and that is how I introduce myself.

   • I design and operate a RAG service over operational conversation history: semantic contexts grouped by topic rather than by time, hybrid vector and keyword search on PostgreSQL with pgvector, and query routing based on how broad the question is.
   • I build the agent layer with LangGraph and LangChain 1.0: a multi-server MCP client that degrades gracefully when a server is unavailable, a scoped tool registry, response streaming over Server-Sent Events and tracing with LangSmith.
   • I stood up a memory service with three specialized stores behind a single gateway, where facts are invalidated with an evidence stamp rather than overwritten, so we can reconstruct what was known at any point in time.
   • I write my own MCP servers with FastMCP over streamable HTTP: API key authentication, Docker image, Helm chart with a persistent volume and ingress restricted by IP allowlist, all deployed by me onto the production cluster.
   • I maintain the frontend in Next.js 16 and React 19 with internationalization by BCP 47 tags across nine regions, and tests in three layers with Vitest, Testing Library and Cypress with cypress-axe.

   • Python3.12
   • FastAPI
   • LangGraph1.0
   • MCP
   • PostgreSQL + pgvector
   • Neo4j
   • NATS
   • Next.js16
   • React19
   • Kubernetes
   • Helm3
   • Docker

2. Aug 2022 –Jan 2026

   Full-Stack Developer, with technical leadership of the frontend

   Talentus · Gran Canaria, Spain

   Online training, sales management and public funding compliance reporting platform: 3,784 commits, sixth contributor out of around thirty-five authors.

   • I led the end-to-end modernization of the interface: I replaced an off-the-shelf template with an architecture we built ourselves, defined the team’s technical standards and style guide, and built a library of reusable components.
   • I mentored other developers through systematic code review and coordinated the work between the frontend and backend teams and the stakeholders in agile ceremonies.
   • I ran an infrastructure provider migration and coordinated several microservice projects running in parallel.
   • I took ownership of entire Django domains: advertising campaigns, social media automation, a public portal with technical SEO, and a statistics charting layer. In 2025 I moved to integrations, building a workflow engine with service-to-service authentication and retries.
   • I optimized production queries with fast and slow paths and cache invalidation, and worked across 205 Behave scenario files on a GitLab CI pipeline with self-hosted runners.

   • Django4.2
   • Django REST Framework
   • Celery
   • Django Channels
   • PostgreSQL
   • React17
   • TypeScript
   • Material UI5
   • Redux
   • Auth0
   • Behave
   • GitLab CI

05 Teaching ↓

Company work is described through skills and architectural decisions. No internal names, no clients and no business figures.

1. 01 · AI and agents

   A complete agent layer, from zero to a shipped container in a day

   The problem

   The agents had to use the business systems as tools behind a permission layer, never with direct access to their databases. That meant a new service with authentication, scoped permissions and streaming responses, and it meant now.

   The approach

   I broke it into seven numbered pull requests: project scaffolding, per-environment configuration, authentication, a scoped tool registry, an MCP client able to talk to several servers at once and degrade gracefully when one is unavailable, response streaming over Server-Sent Events, and a React dashboard with Vite. Behind it, Nginx as a proxy keeping the API key server-side, tests, a Docker image, continuous integration and documentation.

   The result

   The service was left with the whole pattern in place, not as a prototype, and went into production later. On that base we built a canonical entity resolution agent with confidence and risk rules, which escalates anything it cannot resolve on its own to human validation. The speed did not come from cutting corners: it came from having the architectural pattern internalized.

   numbered pull requests in a single day

   7

   from scaffolding to container and CI

   1 day

   • Python 3.12
   • FastAPI
   • LangChain 1.0
   • LangGraph
   • langchain-mcp-adapters
   • LangSmith
   • +4

2. 02 · Applied security

   Federated sign-in with OIDC, shipped in a single day

   The problem

   A self-hosted secrets manager had to go behind mandatory single sign-on, with no username-and-password back door. Authentication is the last thing you can afford to leave half-finished.

   The approach

   An OIDC client with signature validation against JWKS, entry and callback endpoints with an audit log, and a schema migration for existing users. I added two things almost nobody does: a threat model written before touching any code, and an automated test for the algorithm confusion attack. To avoid depending on the real provider locally, I set up a mock identity provider and exercised the flow end to end.

   The result

   Mandatory single sign-on in production, with Prometheus and Grafana watching the service, backup, restore and diagnostic scripts run through ShellCheck, and TruffleHog in the pipeline so no secret slips into a commit.

   from threat model to flow in production

   1 day

   algorithm confusion covered by an automated test

   alg=none

   • OIDC
   • OAuth2
   • JWKS
   • Vaultwarden
   • PostgreSQL 16
   • Nginx
   • +5

3. 03 · Evaluation with data

   Three agent memory architectures, measured before choosing

   The problem

   The agents needed a memory that does not invent things and can be audited. The market offers managed options from all the major vendors, and choosing on instinct costs you every month on the bill and every week in poorly grounded answers.

   The approach

   I built a shared benchmark with ground truth, an expected output schema and a scoring rubric, plus a real-time cost guard with a hard limit so no evaluation could run away. On that base I designed three specialized stores behind a single gateway that routes on write and merges on read: Neo4j 5 with Graphiti for relationships with temporal validity, Mem0 for experiential memory, and PostgreSQL with pgvector for canonical facts. Facts are invalidated with an evidence stamp, never overwritten.

   The result

   The decision was documented with the accuracy and the cost per operation of each option, not with an opinion. The service is in production, instrumented with OpenTelemetry, and its dashboard draws the memory graphs with @xyflow/react and dagre so auditing is visual rather than a hand-written query.

   architectures compared on the same benchmark

   3

   real-time cost guard on every evaluation

   Hard limit

   • Neo4j 5
   • Graphiti
   • Mem0
   • PostgreSQL + pgvector
   • FastAPI
   • OpenTelemetry
   • +2

4. 04 · Backend and operations

   Self-hosted n8n in queue mode, delivered with an emergency runbook

   The problem

   Business processes had to be automated without depending on the managed version of n8n and without the data leaving the organisation’s own infrastructure. And a service like that is worth nothing if nobody can bring it back up when it fails in the middle of the night.

   The approach

   I stood it up with Docker Compose: n8n in queue mode, PostgreSQL 15 as the state database, Redis 7 as the job queue, and health checks plus CPU and memory limits on every container so a runaway workflow cannot take the rest down with it. Integration with the platform backend runs over service-to-service token authentication with retries. And I wrote in Bash what you actually need once the service is alive: backup, restore, a health monitor, a stress test and manual scaling.

   The result

   It shipped with sixteen operations documents — high-availability architecture, emergency runbook, operations guide, backup strategy, alerting and production verification — and with the embedded credentials stripped out of the repository. Automating the work is the easy half: what gets handed over is a service somebody else can run without calling me.

   operations documents handed over with the service

   16

   backup, restore, monitoring and stress-test scripts

   14

   • Self-hosted n8n
   • Docker Compose
   • PostgreSQL 15
   • Redis 7
   • Bash
   • Health checks and resource limits
   • +1

5. 05 · Web performance

   From 46 MB to 4 MB of images on a live site

   The problem

   A restaurant with a menu and a photo gallery was serving 46 MB of images. On a phone on mobile data, standing outside the door deciding where to eat, that is not a slow site: it is a site that does not exist.

   The approach

   Bulk processing with Pillow from Python, WebP with JPEG fallbacks via a picture element and responsive srcset, and a high-priority preload of the LCP image. Critical CSS inlined in the head so the first block paints before the bundle lands, and a loading skeleton system that detects whether the container holds an image, a video or an embedded frame and applies the right strategy to each, with a pure CSS fallback in case the script fails.

   The result

   46 MB of images turned into 4 MB, with individual reductions of up to 98.4%. The same work left the entire bilingual menu, 124 dishes, served from a single data file and switching language without a reload.

   total weight of the site’s images

   46 MB → 4 MB

   largest reduction on a single image

   98.4%

   • Astro
   • Tailwind CSS 4
   • astro:assets
   • Pillow
   • WebP
   • Cloudflare Pages

6. 06 · Architecture

   Hexagonal analytics: dropping the vendor without touching the domain

   The problem

   Analytics on the main frontend was tied to an external vendor. Any change of vendor, or any outage on their side, worked its way into the product code, which is exactly where a third-party dependency must never reach.

   The approach

   Hexagonal architecture, with the full discipline: a repository interface that defines what the domain needs, a storage manager behind it, and a transport layer with a circuit breaker and retry so a vendor outage can neither drag the interface down nor lose events. The domain has no idea who is on the other side.

   The result

   When the call came to drop the external vendor, it was dropped: the adapter was swapped and the domain was left untouched. That is precisely the ports and adapters argument, demonstrated in production instead of on a whiteboard.

   domain changes when the vendor was dropped

   0

   regions served with BCP 47 tags, one of them RTL

   9

   • TypeScript 5.9
   • Next.js 16
   • React 19
   • Hexagonal architecture
   • Vitest

Languages

• Python3.12
• TypeScript5.9
• JavaScript ES2020+
• SQL
• Bash
• Semantic HTML5
• Modern CSS

Frontend

• React19 and 17
• Next.js16
• Astro6
• Tailwind CSS4
• Radix UI
• Vite7
• Three.js with React Three Fiber
• Material UI5
• Anime.js4
• Zod
• React Hook Form
• TanStack Table

Backend

• FastAPI
• Django4.2
• Django REST Framework
• Celery
• Django Channels
• Uvicorn
• Gunicorn
• Async SQLAlchemy2
• Alembic
• Pydanticv2
• asyncpg

AI and agents

• LangGraph1.0
• LangChain1.0
• MCP (Model Context Protocol), server and client
• FastMCP
• langchain-mcp-adapters
• LangSmith
• OpenAI API
• RAG with hybrid search
• embeddings
• Graphiti
• Mem0
• spaCy
• scikit-learn

Data and messaging

• PostgreSQL16
• pgvector
• Neo4j 5 with a bitemporal graph
• Redis7
• MySQL and MariaDB
• MongoDB
• NATS as an event bus
• Redis-backed queues

Containers and orchestration

• Docker
• Multi-environment Docker Compose
• Kubernetes
• Helm3
• Traefik as Ingress Controller
• cert-manager with Let’s Encrypt
• NFS storage

Platform and automation

• Linux (Rocky and Debian)
• Nginx as a reverse proxy with TLS
• certbot
• systemd
• firewalls and secure remote access
• self-hosted n8n in queue mode

Observability

• Prometheus
• Grafana with dashboards and alerts
• structlog
• OpenTelemetry

Security

• OIDC and OAuth2 with JWKS validation
• Service-to-service JWT
• Self-hosted Vaultwarden
• Content Security Policy
• TruffleHog in the pipeline (CI)

CI/CD and deployment

• GitHub Actions
• GitLab CI
• GitHub Container Registry
• release by version tag
• Cloudflare Pages with declarative headers and redirects

Quality and testing

• pytest with async and parallel support
• Vitest
• Jest
• Cypress with cypress-axe
• Behave (Gherkin)
• mypy in strict mode
• Ruff
• ESLint
• Prettier
• ShellCheck

Mobile (learning project)

• React Native0.74
• Expo SDK51
• Expo Router
• NativeWind
• Jest 30 with jest-expo

Tooling

• uv
• pnpm
• npm
• Git
• GitHub CLI
• Playwright

Everything on this list has commits of mine behind it. That is why you will not find Terraform here, or public cloud, or languages I do not write: a short, true list answers a technical interview better than a long one. The mobile block is a learning project, and it stays here for what came next: I went back two years later, documented that coverage was zero and closed it out with 45 tests in seven suites.