Senior Ruby engineer. 8 years in backend, 7 of them with Rails in production.

I work on the unglamorous half of high-traffic Rails monoliths: query plans, Kafka consumers, billing correctness, incident response and security. My bias is measurement over opinion — profile before optimising, EXPLAIN ANALYZE before merging, and publish the negative results too.

Day job: a SaaS platform serving ~20M backend requests a day across 30+ third-party integrations — a Rails 5.2/6.1 monolith plus a Ruby 3.2 Kafka service on a shared PostgreSQL. I carry production releases, on-call and post-mortems for that code.

Performance

• Cut an RSpec suite from 7:33 to 4:15 (−44%, 6,738 examples). Profiled with test-prof: factory.create was 77.6% of runtime, and the root cause was a factory trait creating every tenant twice. Parallel run: 77 seconds.
• Replaced a daily 46,983-event Kafka fan-out with a single GROUP BY … HAVING query → 83 events. The queue's daily drain went from 2h 37m to ~17s. Behavioural trade-off measured at 0.003% over 1.18M rows before merging.
• Fixed an endpoint that ran 900+ seconds: an OR over two daterange expressions disabled the GIST index and forced a seq scan over 28.7M rows. Rewrote it as LATERAL + UNION ALL so each branch stays sargable — planner cost 869B → 313k.
• Profiled a 14,767-example suite and proved the remaining bottleneck was CI infrastructure, not spec code. Measured and rejected three plausible fixes rather than shipping churn.

Reliability

• 50+ production incidents resolved: on-call rotation, timelines, root cause, post-mortems, runbooks.
• Designed an idempotent Kafka retry pattern that eliminated duplicate records on consumer retries.
• Found refund receipts failing 100% for six months through log forensics, then closed it with the payment provider.

Security

• Found and remediated 8 OWASP Top-10 issues: IDOR in a mobile API, SSRF in an iCalendar importer (resolver-level guard, redirect bypass closed), open redirects in payment flows, brute force in password reset, unauthenticated resource deletion.
• Authored a production access policy: L1/L2/L3 tiers, Kubernetes RBAC and Git group mapping.

A multi-tenant SaaS I build and operate end to end — retrieval and ranking over a private text corpus, with a semantic search layer on top.

Rails 8.1 / Ruby 3.3, PostgreSQL 18 + pgvector (HNSW), Hotwire, Solid Queue, Kamal, object storage. 2,700+ RSpec examples and Playwright visual QA. Every release is deployed with Kamal and verified afterwards. Migrated the entire app between hosts with row counts and sequences checked across all 34 tables before cutover, on a two-week rollback window.

Production defects I debugged there: a foreign-key lock escalation deadlock that lost inbound messages (FOR NO KEY UPDATE + retry), an unreachable rescue RecordNotUnique inside an outer transaction (savepoints), SSRF DNS-rebinding closed with IP pinning, and pgvector recall tuning.

• Initiated LLM-based review of merge-request diffs in CI, including the security design that made it acceptable: the model never receives a repository token, a deterministic step posts the comment, a separate spend-capped key, turn limits, prompt-injection acceptance criteria.
• Built a retrieval layer on pgvector with measured recall tuning, PII redaction before anything reaches a provider, and an extraction pipeline that turned free-text records into a searchable corpus without manual tagging.
• Use coding agents daily — and know where they fail: reliable for static analysis, not for self-verification, so verification stays centralised and measured.