Backend & Cloud Engineering
most people call me Diva
I build backends that stay fast when the traffic actually arrives.
Five years of backend and cloud engineering in production — a multi-tenant platform across six clouds, identity for 4M+ users, pipelines carrying 100K+ events an hour, and $120K a year taken off the cloud bill.
Not a mock-up. This is the sequence from a production AI SaaS platform: P95 pulled from 2s to under 1s with indexing and Redis, then the notification path moved from Java to Go — 40% more throughput on 30% less AWS spend.
Work
Five years, three companies, one direction of travel. Where there is a bar further down, it is something I measured before and after.
Each step needed the one before it. You cannot put Zero Trust between services until you have had to run those services at three in the morning.
I build and operate a Kubernetes-based multi-tenant cloud platform that provisions AI and BI environments across GCP, AWS, Azure, StackIT, IBM Cloud and self-hosted — a Spring Boot control plane driving Temporal workflows, Helm and Terraform.
Six target platforms with six different ideas of what a network, a disk and an identity are, reconciled behind one control plane. Every environment has to come up isolated from its neighbours, reproducible from the spec, and recoverable when a provision dies halfway through.
Owned the technical roadmap for an AI SaaS platform serving 70+ enterprise clients, and led a five-person team through delivery. Designed four Java services from scratch and held them to resilience standards so the platform stays available when inference traffic spikes. Alongside that: HLD and LLD for new surfaces, 50+ code reviews, and a test-coverage floor of 90%.
Built and operated the backend of a Keycloak-based identity SaaS used by 4M+ users across banking and public-sector clients. Shipped custom authentication flows — QR login, passkeys, magic links — through Spring Boot and the Keycloak SPI, and kept them compliant under audit. Also built the internal and external APIs other teams consumed, and the React dashboards that read them.
Ownership
Owning what gets built and why, what it costs to run, and whether the people around it get better. This is the part that doesn’t fit in a commit history.
Systems
Some are running, some are being built. I would rather name what I am actually working on than pad this out with tutorials.
Role-based access control over Keycloak, handling multi-tenant permissions and the audit trail compliance actually asks for. Admins manage their own roles instead of filing a ticket.
P95 authorisation latency down 80%. 13 hours a week back for admins, and 75% fewer support tickets.
A thread-safe LRU cache in the spirit of Caffeine: O(1) lookups, per-entry TTL, asynchronous refresh, and a background sweep that expires entries without blocking readers.
50–60K ops/sec with predictable O(1) access under concurrent load — measured, not estimated.
github.com/dhvakr/DCache →The question every operator asks and no dashboard answers: what can this pod actually reach, right now? It composes NetworkPolicies, RBAC bindings and service-mesh identity into a single reachability answer — and names the exact rule doing the allowing, so you can go and change it.
A question I have answered by hand across six platforms. That is usually the sign it should be a tool.
A control plane that provisions and reconciles whole product environments across AWS and Azure from one declarative spec. Built on durable workflows, so a provision that dies halfway resumes rather than stranding a tenant in a half-built state someone has to unpick by hand.
Drift detection and rollback as first-class operations, not a runbook.
Catches a query-plan regression before it reaches production: snapshot the plan for every query in CI, then fail the build when one quietly turns into a full-table scan.
Written because I found one carrying 79% of production RDS load, and nothing in the pipeline would have caught it.
Building now
Agents can already reach your database, your cloud account and your customers' data. What nobody can answer is what they touched, on whose behalf, and what it cost. Ikat puts scoped identity, policy and a complete record in the path — so security has a way to say yes.
Stack
A flat wall of thirty logos tells you nothing. This is the honest version.
On the record
Off the clock
When I am not reading a query plan I am somewhere on a long drive, or working out what the city has decided is worth queueing for this month. Both are reconnaissance, in their own way.
Contact
Backend and cloud work, system design arguments, agent infrastructure, or a talk. Mail is the fastest way to reach me.
[email protected]