Skip to content
Available for select contracts

Backend systems built for scale, security & silence

Backend Software Engineer

Senior-minded backend engineer specialising in NestJS and Spring Boot microservices. I design multi-tenant SaaS platforms, harden APIs against real attack surfaces, and tune PostgreSQL until the query plans stop hurting.

  • NestJS
  • TypeScript
  • Java · Spring Boot
  • Microservices
  • PostgreSQL
  • Docker
  • Redis
  • NATS
View projectsContact meRésumé

Dhaka, Bangladesh · Open to remotezaagsys.com

query.controller.ts
@Controller('tenants/:id/query')
@UseGuards(JwtAuthGuard, TenantGuard)
export class QueryController {
 
  @Post()
  @Throttle({ default: { limit: 30, ttl: 60_000 } })
  async query(@CurrentTenant() tenant: Tenant,
           @Body() dto: QueryDto) {
    // scope is derived from the token, never from the client
    const chunks = await this.retriever.search({
      tenantId: tenant.id,
      query: dto.question,
      topK: 8,
    });
 
    return this.llm.stream(buildPrompt(chunks, dto));
  }
}
terminal

$ docker compose up -d --build

postgres · redis · nats healthy

$ pnpm migration:run && pnpm start:prod

migrations applied · 0 pending

→ Nest application successfully started

Core technologies: NestJS, TypeScript, Spring Boot, PostgreSQL, Redis, Docker, NATS, Microservices, TypeORM, Socket.io, Nginx, CI/CD.

About

Backend engineer, four years in production systems

I build the half of the product nobody sees: multi-tenant APIs, event-driven services, and the database work that keeps them fast under load. NestJS and TypeScript today, Java and Spring Boot before that, PostgreSQL underneath all of it.

I am a backend engineer based in Dhaka, four years into shipping systems that other people depend on. I started on PHP and Laravel internal tools, moved to Java and Spring Boot for product work, and now spend my days in NestJS building enterprise services.

At Zaag Systems I work across three products: a multi-tenant RAG platform, an AI automation ecosystem for a top-10 global printing company, and a real-time dispatch backend serving mobile apps in Saudi Arabia. On the printing ecosystem I led the transition from a proof-of-concept monolith to five independently deployable services communicating over NATS behind a Kong gateway.

The work I am best at is the work where being right matters more than being novel: tenancy boundaries that hold, transactions that do not leave partial state, consumers that survive a redelivery, and query plans that stop hurting. I am open to remote backend roles and select contracts.

At a glance

Experience
4+ years, backend-focused
Currently
Software Engineer · Zaag Systems Ltd
Based in
Dhaka, Bangladesh · UTC+6 · remote
Domains
Multi-tenant SaaS · AI platforms · Real-time · Commerce
Availability
Open to select contracts
records orchestrated
1M+records orchestratedTCC Reader ingestion feeding downstream AI processing
services designed
5services designedPOC monolith split into an event-driven ecosystem on NATS
faster API responses
25%faster API responsesIndexing and query optimisation on high-volume paths
fewer environment bugs
20%fewer environment bugsStandardised Docker development environments across the team

Request lifecycle

Every request that reaches one of my services passes six checkpoints before it is allowed to change anything.

  1. Step 1: Edge

    Throttled per client and per plan tier. Helmet headers on, CORS locked to known origins. Abuse is cheapest to stop before it reaches application code.

  2. Step 2: Guard

    JWT verified, role checked, then resource ownership checked on top of the role. A valid token is permission to ask, never permission to receive.

  3. Step 3: Validation

    Whitelist DTOs. Unknown fields are rejected outright rather than silently ignored, so a client cannot smuggle a property the service later trusts.

  4. Step 4: Service

    Domain logic with one clear responsibility, and every multi-step mutation inside an explicit transaction. Partial writes are not a bug class I ship.

  5. Step 5: Data

    Indexes declared at entity-definition time for foreign keys and hot query paths, with a cached read path that invalidates on write instead of expiring on hope.

  6. Step 6: Events

    Slow work leaves the request. Queue consumers are idempotent with retry and dead-letter handling, so a redelivery costs nothing and a failure is never silent.

Experience

  1. Oct 2024 — Present

    Software Engineer · Zaag Systems Ltd

    Dhaka, Bangladesh

    Enterprise backend services across three products: the Toppan microservices ecosystem, the ZAAG AI multi-tenant RAG platform, and the Dr. Wash dispatch platform.

    • Led the transition of a POC monolith into a production microservices ecosystem, designing five core services: Auth, Activity, Email, Job, and TCC Reader
    • Built the TCC Reader service to ingest and orchestrate over 1M external records for downstream AI processing
    • Implemented event-driven communication over NATS so services decouple and scale independently
    • Architected multi-tenant NestJS infrastructure with RBAC and organisation-level data isolation for ZAAG AI
    • Resolved N+1 query issues on high-volume data paths, cutting database overhead and latency
    • NestJS
    • TypeScript
    • Kong API Gateway
    • NATS
    • PostgreSQL
    • Redis
    • Docker

  2. Sep 2022 — Sep 2024

    Junior Software Engineer · Zaag Systems Ltd

    Dhaka, Bangladesh

    Started on PHP/Laravel internal business applications, then moved to Java and Spring Boot for product work.

    • Developed and maintained RESTful APIs in Laravel (Eloquent ORM, service container, MVC) with MySQL for internal business applications
    • Built a complete Restaurant Management System and POS in Spring Boot, covering accounting, inventory management, and QR-code ordering
    • Integrated Uber Direct and DoorDash to automate order fulfilment and real-time delivery tracking
    • Implemented WebSockets for live order tracking and kitchen notifications, synchronising front- and back-of-house operations
    • Improved API response times by 25% through indexing and query optimisation, and standardised Docker development environments, cutting environment-related production bugs by 20%
    • Java
    • Spring Boot
    • PHP
    • Laravel
    • MySQL
    • WebSockets
    • Docker

  3. Feb 2022 — Aug 2022

    Embedded Software Engineer · Baraka Techsol

    Canada · Remote

    Backend contributions alongside embedded monitoring hardware deployed to production environments.

    • Contributed to a PHP/Laravel backend across 3+ projects, integrating third-party APIs to extend application functionality
    • Built and deployed ESP32/Arduino-based monitoring solutions in multiple production environments
    • PHP
    • Laravel
    • MySQL
    • ESP32 / Arduino
    • REST APIs

How I build

Boundaries before code

If a layer's responsibility is blurry, the code will be too. I decide what the controller, service, and repository each own before writing any of them.

Migrations, never synchronize

Schema changes are versioned, reviewed, and reversible. Production has never auto-synced an entity in anything I have shipped.

Reuse the primitive that exists

If the project already has a guard, pipe, or interceptor, I extend it. A second way to do the same thing is a maintenance bill someone else pays.

Boring deploys

Reproducible container builds and logs you can actually grep beat clever infrastructure at 3am, every time.

Projects

Shipped, live, and carrying real traffic

Every project below is in production. Click any card for the architecture decisions behind it.

Featured

ZAAG AI

Multi-tenant RAG SaaS platform

A multi-tenant NestJS platform with organization-level data isolation and RBAC, an AI ingestion pipeline for automated dataset processing and RAG retrieval, and centralized configuration services for system-wide resource monitoring.

  • Multi-tenant NestJS infrastructure with RBAC and organization-level data isolation
  • AI ingestion pipeline with a messaging system for automated dataset processing and RAG retrieval
  • Centralized configuration services monitoring system-wide resource usage and AI configuration
  • Asynchronous processing keeps heavy dataset work off the request path
  • NestJS
  • TypeScript
  • Multi-Tenancy
  • RBAC
  • RAG
  • Messaging
  • PostgreSQL
  • Docker
Live site
Top-10 global printing company

Toppan Microservices Ecosystem

POC monolith → five-service production ecosystem on NestJS & NATS

Enterprise backend for AI-driven automation workflows at a top-10 global printing company. I led the move from a proof-of-concept monolith to a production microservices ecosystem of five services behind a Kong API gateway.

  • NestJS
  • TypeScript
  • Microservices
  • Kong API Gateway
  • NATS
  • PostgreSQL
  • Docker
Enterprise system — no public URL

Dr. Wash

On-demand car wash platform — real-time dispatch engine

The NestJS backend behind the Dr. Wash mobile apps: a real-time dispatch engine on Socket.io and PostgreSQL/PostGIS, geo-hash proximity matching for service notifications, and booking lifecycle management with background job processing.

  • NestJS
  • TypeScript
  • Socket.io
  • PostgreSQL
  • PostGIS
  • Geo-hash
  • Docker
Google PlayAdmin console is staff-only

CitizenPrep

Full-stack citizenship exam preparation platform

An end-to-end learning platform: adaptive practice tests, progress analytics, and subscription billing. I built both the API and the client.

  • NestJS
  • TypeScript
  • PostgreSQL
  • React
  • Tailwind CSS
  • Stripe
  • Docker
Live site

Northern Handicraft

E-commerce platform for handcrafted goods

A production storefront and commerce backend — catalog, cart, checkout, and order fulfilment for a handicraft retailer.

  • Node.js
  • PostgreSQL
  • REST API
  • Payments
  • Docker
  • E-commerce
Live site
Stack

The tools, and how deep I go with each

Core means daily and production-proven. Strong means shipped and comfortable. Working means I am productive with it but would not call myself the expert in the room.

Backend

Where I live. API design, domain modelling, and the boundaries between them.

  • NestJS — Core proficiency
  • TypeScript — Core proficiency
  • Node.js — Core proficiency
  • Java — Strong proficiency
  • Spring Boot — Strong proficiency
  • Microservices — Strong proficiency
  • REST & OpenAPI — Core proficiency
  • JWT & Passport.js — Core proficiency
  • NATS Messaging — Strong proficiency
  • WebSockets / Socket.io — Strong proficiency
  • Kong API Gateway — Strong proficiency

Databases & Caching

Schema first, indexes on purpose, transactions where state changes.

  • PostgreSQL — Core proficiency
  • TypeORM — Core proficiency
  • Prisma — Strong proficiency
  • Redis — Core proficiency
  • MongoDB — Working proficiency
  • PostGIS — Strong proficiency
  • MySQL — Strong proficiency
  • Query optimisation — Strong proficiency
  • Migrations — Core proficiency

DevOps & Cloud

Reproducible builds, boring deploys, and logs you can actually search.

  • Docker — Core proficiency
  • Docker Compose — Core proficiency
  • CI/CD (GitHub Actions) — Strong proficiency
  • Nginx — Strong proficiency
  • Linux — Strong proficiency
  • AWS — Working proficiency
  • Kubernetes — Working proficiency
  • Observability & logging — Strong proficiency

AI & Data Services

Retrieval pipelines that return the right chunk, not the nearest one.

  • RAG architecture — Core proficiency
  • AI ingestion pipelines — Strong proficiency
  • LLM API integration — Core proficiency
  • Vector search — Strong proficiency
  • n8n automation — Strong proficiency
  • AI coding agents — Strong proficiency
Contact

Let's build something that scales

Backend architecture, API design, a system that's buckling under growth — tell me what you're working on and I'll tell you honestly whether I'm the right fit.

Reach me directly

Prefer skipping the form? Any of these lands in the same inbox.

Email

zaag.ai.2026@gmail.com
LinkedInConnect professionallyGitHubBrowse the code

Available for select contracts

Typical reply within 24–48 hours. Dhaka, Bangladesh · Open to remote.

Send a message

Rate limited and spam filtered. Your address is used only to reply.