Lead a 14-engineer team (Django, Node, Go, React), owning architecture, engineering standards and technical direction across 25+ production systems
Lead solution architecture across projects, defining scalable system design and technical direction for development and infrastructure teams
Establish engineering standards, evaluate technology and stack choices, and guide cross-team integrations to ensure long-term platform stability
Identify risks early and drive architectural decisions that improve performance, maintainability, and growth readiness
Engineering Team Lead - Architecture & Full-Stack Delivery
Nano Kernel Ltd, Bengaluru | January 2020 - Present
Key Projects & Achievements:
Enterprise ERP/DMS Platform (Microservices SaaS)
Architected the decomposition of a monolithic ERP into independently deployable Management, Assets and HRMS microservices (database-per-service), owning the service boundaries and integration contracts
Designed OAuth2 service-to-service auth and JWT single sign-on, with Redis pub/sub event-driven user & permission synchronization across services
Established the platform's API standards - 1000+ REST APIs with real-time WebSockets and OpenAPI/Swagger contracts - spanning 11+ business domains
Drove a 60% performance gain via Redis caching and asynchronous task pipelines
Standardized Dockerized deployments and GitHub Actions CI/CD across all services
National Live-Classroom Platform (EdTech at National Scale)
Architected and built the backend of a live-classroom platform designed for ~1.5M government schools - one teacher broadcasting to many single-device classrooms
Chose a modular monolith over microservices on purpose: cross-cutting joins and six-figure-row audience expansion made service boundaries a liability, so module boundaries are enforced in CI via import-linter instead
Scaled through process roles (WSGI web, ASGI media, Celery workers), a LiveKit media plane for one-to-many broadcast, and CV-based headcount attendance
Operations Intelligence (Applied ML & LLM)
Shipped an ML service for a seaport command-and-control platform: time-series forecasting (ARIMA / Holt-Winters with backtesting) and multi-method anomaly detection (IsolationForest plus statistical detectors)
Built a model registry with drift monitoring, and a grounded, provider-neutral LLM layer that narrates live metrics without hallucination - it only ever sees pre-computed figures
Instrumented the platform with OpenTelemetry + Jaeger distributed tracing and span-derived RED metrics (Prometheus, Grafana, Alertmanager)
IoT Platform (Telemetry & Device Management)
Architected a multi-tenant IoT backend (Node.js/TypeScript, Express, TypeORM) processing real-time telemetry over MQTT/TLS
Defined the PostgreSQL + InfluxDB data architecture for time-series telemetry and analytics
Designed a secure OTA firmware-update pipeline and WebSocket-driven monitoring & alerting
Delivered 100+ documented REST APIs (Swagger) with versioned TypeORM migrations
A single Django monolith spanning 11+ business domains had become a release bottleneck - every change risked the whole system, teams blocked each other, and scaling meant scaling everything at once.
Key Decisions
Decomposed into Management, Assets and HRMS services along domain boundaries
Database-per-service to remove shared-schema coupling (PostGIS where geospatial)
Management as the OAuth2 provider + JWT SSO issuer; services verify centrally
Redis pub/sub events to replicate users & permissions, not synchronous calls
OAuth2 client-credentials for secure service-to-service traffic
The Outcome
Independent deploys per service; teams ship without cross-blocking
Failures degrade gracefully instead of taking down the platform
1000+ REST APIs under shared standards; 60% faster via Redis caching
DjangoDRFPostgreSQLPostGISRedisOAuth2JWTDocker
NCG - National Live-Classroom Platform
// ~1.5M schools, and why it is deliberately NOT microservices
The Problem
A national live-teaching platform for government schools: one teacher broadcasting to many single-device classrooms, attendance from a teacher-triggered still, and audience expansion that touches six-figure row counts in a single operation.
Key Decisions
Modular monolith over microservices - every core table foreign-keys into one tree, and cross-service joins would have become transaction-less HTTP fan-out
Module boundaries enforced in CI with import-linter, so the monolith stays modular under team pressure
Independent scaling via process roles (WSGI web, ASGI media, detection and outbox workers, beat) instead of a service split
LiveKit media plane for one-to-many broadcast, CV-based headcount attendance, and a transactional outbox for reliable fact publishing
The Outcome
One deployable unit with clean internal boundaries - transactions kept, fan-out joins avoided
Architecture chosen from the data model, not the trend - the deliberate counter-example to the ERP microservices story
Operate fleets of edge devices behind NAT and firewalls - give each device a strong identity, ingest telemetry over constrained links, and control devices remotely without ever opening an inbound port on them.
Key Decisions
Per-device identity via mutual TLS - a platform CA signs each device's CSR; the cert CN is bound to the device record and re-verified on every request
Multi-protocol ingestion (MQTT, CoAP, WebSocket, AMQP) over TLS to fit constrained and real-time workloads
Reverse, device-initiated connectivity - devices hold a persistent outbound channel so the platform pushes commands and OTA through NAT with zero inbound ports
Strict tenant isolation on every device, telemetry and alarm path
The Outcome
Strong cryptographic per-device identity and zero-inbound remote control
Protocol flexibility from low-power sensors to live dashboards
The open-source dpdpstack erasure engine had to become a managed service - so teams get DPDP consent, erasure, audit and certificates as an API instead of hand-rolling them.
Key Decisions
Django/DRF backend that wraps the dpdpstack-python-sdk engine as a hosted, multi-tenant API
Tenant-scoped API keys - secret (server) and publishable (browser) - with per-key capabilities and origin allowlists
Signed, independently verifiable Certificates of Erasure backed by a managed RS256 signing-key vault
Evidence-only ingestion (opaque refs + hashes, never PII) keeps it zero-egress by design
The Outcome
Turned an OSS library into a counter-signed, auditable compliance platform
Consent, DSR and breach workflows exposed as documented (Swagger) APIs