Senior Identity Engineer at TWIN (IOTA Foundation), based in Lisbon. 14 years building identity, verifiable-credential and regulated-data systems in Europe and Southeast Asia, as engineer, technical lead and founder. At TWIN: an OID4VP verifier interop-tested against the EUDI Reference Wallet, a GLEIF vLEI to IOTA DID bridge, and an OID4VCI credential issuer. Before that, principal engineer at Softmax in Bangkok: a digital identity platform (OIDC/CIBA, KYC) now behind 10+ partner products, remote patient monitoring, and a KYC-gated digital-asset exchange.

What I’m hired for is judgment: what to build, what it costs in a year, and when the confident answer is wrong. I’ve worked in Singapore, Thailand, Malaysia, China, Iran, the UAE, Turkey and Portugal, which is where I learned to read a market before reading a spec.

TECHNOLOGY STACK

• Identity & Trust: OID4VP/OID4VCI, SD-JWT VC (selective disclosure, KB-JWT holder binding), DCQL, JARM, W3C Verifiable Credentials (issuer + verifier), Bitstring Status List, KERI/ACDC/IPEX, vLEI, DID (did:iota, did:webs), OIDC/CIBA, OAuth 2.0, EUDIW (HAIP profile), trust frameworks, Casbin (ABAC/RBAC), Argon2, X.509/PKIX
• Standards bodies: OpenID Foundation (OID4VP, OID4VCI, HAIP), IETF (SD-JWT, OAuth 2.0, JOSE), W3C (Verifiable Credentials, DIDs), GLEIF and Trust over IP (vLEI, KERI, ACDC), EU (EUDI Wallet ARF, AI Act)
• Languages: TypeScript/JavaScript, Rust, Python, Move (IOTA)
• Platforms: Node.js (Fastify, NestJS, Express), Rust (Actix Web, Diesel), Next.js (App Router), React, Vue, React Native
• Infrastructure: PostgreSQL, MySQL, ClickHouse, Redis, HashiCorp Vault, Docker, AWS, Guix (reproducible builds)
• Other Protocols: WebRTC, JWS/JWE/JWT, WebSockets, Nostr

WORK EXPERIENCE

Building the digital identity platform for global trade - bridging GLEIF/vLEI, EU eID, and country-specific KYC with decentralized identity on IOTA.

• GLEIF vLEI ↔ IOTA DID two-way binding - no off-the-shelf bridge between these trust roots, so I built one:
  • Bidirectional cryptographic linkage between GLEIF’s KERI/vLEI ecosystem and IOTA DIDs (did:iota, did:webs): a self-issued Designated Aliases ACDC anchored in the Legal Entity’s KEL/TEL, plus an on-chain W3C VC JWT carrying the KERI anchor seal (KEL anc + TEL iss SAIDs), verified by three independent on-chain authority checks.
  • Full-stack: Move contract (VleiAttestation), Express/Node backend, React 19 + Vite frontend running signify-ts in the browser (keys never leave the device), Sally verifier integration.
• Identity platform on Keycloak - Keycloak as the OIDC authorization server for the TWIN identity stack:
  • Extended Keycloak with a custom SPI for HashiCorp Vault-backed token signing.
  • Multi-tenant IdP: per-realm and shared-realm tenancy, machine-to-machine service accounts
  • Standard OIDC hardening: private_key_jwt client auth (RFC 7523), refresh-token rotation; JWKS verification at the edge.
  • Casbin ABAC + RBAC authorization, GDPR right-to-erasure, and a headless provisioning CLI.
• TWIN Notary - a credential trust anchor, whitepaper to a running service:
  • OID4VCI 1.0 Final issuer (pre-authorized code flow) minting W3C VCDM 1.1 jwt_vc_json credentials signed as a did:iota via Vault, plus an OID4VP 1.0 Final verifier (DCQL) for permissionless presentation.
  • Dual-lane revocation: W3C Bitstring Status List over HTTPS and on-chain RevocationBitmap2022 in the issuer DID document, with configurable strict/resilient policy.
  • Pluggable INotaryProcess core (initiate / advance / finalize) with two backings - contract attestation and KRA (Kenya Revenue Authority) / KYB business verification - plus signed verification-lineage claims across renewals.
• OID4VP verifier on the HAIP profile - interop-tested against the EUDI Reference Wallet:
  • Implemented the x509_hash client ID scheme, SD-JWT VC verification with KB-JWT holder binding, DCQL queries, and JARM direct_post.jwt (ECDH-ES JWE).
  • Caught three bugs in spec review: a silent KB-JWT skip, a JWE dual-version trap, and a DCQL PII leak.

Built a digital identity platform for government use - now backing KYC across 10+ partner products. Currently advisory.

• OIDC/CIBA Identity Platform:
  • Backend in TypeScript (NestJS) and Rust (Actix Web): authentication, digital signatures, push notifications.
  • SDK libraries across TypeScript, Rust, C++, PHP, Python for auth flows, digital signatures, push notifications.
  • Led engineering, ran technical integrations, and served as primary integration contact for partner orgs.
• Delivered IoT Healthcare Solution:
  • BLE application for Bangle.js smartwatch + clinical dashboards for real-time patient monitoring.
  • Patient gateway terminal: vital-signs REST API, WebSocket + WebRTC monitoring interface.
• Launched KYC-gated Digital Asset Exchange & NFT Marketplace:
  • ERC-1155 NFT platform with integrated KYC for regulated digital asset trading.
  • Multi-currency exchange with wallet management and order book logic.
• 99.9% Platform Uptime over 24 Months:
  • Reproducible builds + deployment via Guix - no configuration drift.
  • Containerized deployment (Docker, custom scripts) for 30+ microservices with monitoring.

Solo technical founder - five products, all still running, all paying their own bills.

• Checkoutbay.com - API-first e-commerce with multi-warehouse inventory.
• Formshive.com - Privacy-focused form backend with spam filtering for developers.
• GPTMuse.com - Privacy-first AI platform: pay-per-use access to ChatGPT, Claude, Gemini.
• PantherX.org - Lightweight Linux distribution on GNU Guix; declarative system configuration.
• nostr-ts - Open-source TypeScript SDK for the Nostr protocol.

Co-founded a global real estate social platform - ran the build, the hiring, the investor pitches, and early customer outreach. Wound down in 2020.

• Scaled platform to 50,000 daily active users. Built the social/search platform from scratch - Vue.js frontend, NestJS/Flask backend.
• Secured seed funding - pitched investors, defined technical roadmap.
• Onboarded realtors by running technical integrations personally; built engineering + sales teams.

Hands-on client work - from first call to delivery.

20+ custom web projects (Bootstrap, CMS integrations); analytics dashboards (Metabase, Google Analytics, MySQL).

Infrastructure and integration roles at Q-Windows Thailand, MJM Networks Singapore, and VBH Hardware China.