Zayed Fahim — Backend Engineer

┤proc · experience├┤2 roles · 1 running├

PIDUSERSTIMECOMMAND

2025shomvobR2025.04→now./software-engineer --sde-1 --owns=payroll[+]

├─core HRIS backend — NestJS · TypeScript · PostgreSQL/TypeORM — employee · attendance · leave · roster · approvals · reports · bonus · expense · asset modules → 11+ companies / 2,000+ employees
├─SOLE OWNER of payroll — salary structures → payroll runs → disbursement workflows, end-to-end · monthly payroll for every client company
├─built an AWS KMS-based encryption service protecting employee & compensation data platform-wide
├─BullMQ/Redis background workers on a dedicated worker process — bulk employee Excel imports (500+ rows, per-row validation) · attendance report generation
├─reviews PRs & drives backend architecture decisions across the engineering team · Swagger/OpenAPI · Sentry · GitHub Actions CI/CD
└─earlier as Junior Software Developer — OTP auth & job search on the job-seeker app · job posting & candidate management in the employer dashboard (React · Express.js · PostgreSQL) → promoted to SDE-1 in 2026.02

problem · Payroll is money-critical and unforgiving: every client company must be paid correctly, on time, every cycle — and a re-run or a crash mid-disbursement must never double-pay anyone.

decisions

Modeled payroll as an explicit state machine (salary structure → run generated → approval gate → disbursement) so a run's status is always unambiguous and recoverable.
Made runs idempotent — re-triggering a run reconciles against already-processed line items instead of paying again.
Pushed heavy, slow work (bulk imports, report generation) onto a dedicated BullMQ worker process to keep the request path responsive.
Encrypted compensation/PII with an AWS KMS envelope-encryption service rather than app-level crypto, so key management and rotation live outside the app.

architecture

Shomvob HR · HRIS platform · active

gatewayAPI GatewayNestJS · TS

★ sole ownerpayrollPayrollend-to-end

serviceRoster

serviceApprovals

serviceAttendance

serviceLeave

securityAWS KMSfield encryption

workerBullMQ Workersdedicated process

dataPostgreSQLTypeORM

dataRediscache · queue

outcome · Runs monthly for 11+ companies / 2,000+ employees, with bulk employee onboarding validated at 500+ rows per Excel import.

2024zaynaxS2024.03→2025.01./software-engineer --full-stack[+]

├─NestJS/MongoDB microservices for the zDrop e-commerce platform — product · auth · customer · CMS · WMS · payment — NATS inter-service messaging · Redis caching
├─worked across the health super-app (telemedicine · e-pharmacy · diagnostics) — patient-management, auth & communication services · NestJS backends + Next.js frontends
├─optimized slow MongoDB aggregation pipelines on high-traffic catalog & reporting endpoints
└─shipped a CMS-driven blog for zaynaxhealth.com — marketing publishes self-serve

problem · A single e-commerce codebase for product, auth, customer, CMS, WMS and payment was coupling failures and slowing releases; hot catalog/report endpoints were also slow under load.

decisions

Split domains into NestJS microservices communicating over NATS, with Redis as a shared cache.
Reworked the slowest MongoDB aggregation pipelines and indexing on catalog/reporting reads.

architecture

Zaynax Health · zDrop · past

Product

Auth

Customer

NATS bus

Redis

CMS

WMS

Payment

outcome · Decoupled the six e-commerce domains over NATS and reworked the slowest catalog and reporting read paths.

zayed@fahim:~$

┤svc · systems├┤3 units├

●payroll-engine[ UP ]work · Shomvob HR · private code[+]

end-to-end payroll — salary structures → payroll runs → disbursement · monthly for 11+ companies / 2,000+ employees

problem · Own the correctness-critical payroll domain of an HRIS: generate runs, gate approvals, and disburse — safely, repeatably, per client company.

decisions

Explicit run state machine + idempotent runs (no double-pay on retry).
BullMQ worker isolation for bulk imports / report generation.
KMS envelope encryption for compensation data.

outcome · In production for 11+ companies / 2,000+ employees, monthly.

●clientsync[ DEV ]personal[+]

agency–client platform — 49-entity PostgreSQL schema · 8 modules · sprints · kanban/Gantt · time tracking → invoicing · Stripe dual USD/BDT · permission-string RBAC · SCIM v2 · hash-chained audit logs · Socket.IO · LiveKit

repo: https://github.com/orgs/Client-Sync/repositories

problem · A multi-tenant agency↔client platform: project management, time tracking, and billing, with strict tenant isolation and an auditable trail.

decisions

Multi-tenant via shared schema + tenant_id + row-level scoping (not schema-per-tenant) to keep migrations and ops simple at this scale.
Stripe Connect so invoices generate from tracked time and clients pay in-portal.
White-label client portal via secure slug links — clients pay and collaborate with no account required.
Hash-chained audit logs so tampering with history is detectable.

outcome · Personal build — a 49-entity PostgreSQL schema across 8 modules, with Stripe Connect billing, multi-tenant RBAC, SSO/SCIM, and LiveKit video.

●aiflow[ DEV ]personal[+]

automation SaaS — customers run pre-built n8n workflows from a catalog without seeing the engine · 21 NestJS modules over a Postgres control plane that is sole custodian of credentials · per-account n8n containers provisioned & reaped through the Docker API

repo: https://github.com/orgs/AI-Automation-Flow/repositories

problem · Let customers run automation workflows without ever handling the engine or seeing another tenant's credentials.

decisions

Fail-closed authorization: a boot-time assertion requires all 147 routes to be classified, so an unclassified route stops startup instead of shipping open.
AES-256-GCM credential vault with no read path.
Cookie JWT with refresh-token reuse detection, plus TOTP 2FA.
One n8n container per account, provisioned and reaped through the Docker API.

outcome · A control plane that is the sole custodian of credentials, with no route able to ship unprotected by accident.

┤pkg · skills├┤read-only├

languages

typescriptjavascriptsql

backend

nodenestjsexpressrestgraphqlsocket.ionatsbullmqmicroservices

data

postgresqlmongodbmysqlredistypeormmongooseprisma

frontend

reactnext.jstailwind

cloud & tools

aws (ec2 · s3 · kms)dockergithub actionsstripesupabasesentryjestgit