Vreij Lal's Portfolio

Experience

Mid-Senior Backend & Integration Software Engineer

Dubai, UAE

06/2025 - Present

Daman Markets is a regulated offshore forex brokerage with 50K+ active clients. When I joined, there was no automated bridge between SumSub (where KYC happens) and FXBO CRM (where compliance teams work). Agents were manually checking SumSub status and updating the CRM, which meant compliance data was always stale and human error was constant. I built the entire integration layer from zero: the webhook infrastructure, the sync engine, the observability stack, and two Zendesk tools on top.

KYC/AML Webhook Infrastructure: built from scratch. SumSub fires events whenever an applicant's verification state changes. I built the FastAPI receiver that handles these: HMAC-SHA256 signature verification on every request, a custom sliding-window rate limiter middleware, and a malicious payload blocker that recursively scans JSON up to 5 levels deep for XSS patterns and SQL injection attempts. The app auto-creates its MySQL database and runs all schema migrations at startup, so deployment is a single command. RBAC with JWT tokens controls who can trigger manual syncs. Nginx handles SSL termination, CORS, and reverse proxy to the container.

The hardest part: the applicant level state machine. SumSub has 6+ KYC levels: Daman2025, Daman2025 No-OTP, DamanSelfieVersion, DamanCRM, SOW level, and more. Each level has different verification steps and a different set of columns in MySQL. When an applicant moves between levels (CRM → Daman2025 → SOW), the system has to understand the transition, re-evaluate the overall review result by calling SumSub's requiredIdDocsStatus endpoint, and decide what to write where. I wrote explicit state machine logic routing every level-change event through the correct handler, including a 1:1 → 1:N questionnaire schema migration that had to execute idempotently on live production data.

Sync flag tracking and idempotency. SumSub retries webhooks on any non-200 response. Without idempotency, a retry doubles an FXBO CRM update. I solved this using a combination of unique applicant IDs as natural keys with idempotent upsert SQL, sync-flag columns that mark records processed, and conditional sync logic that only pushes to FXBO when the data has actually changed. The result: zero duplicate CRM records since launch.

Apache Airflow DAG orchestration. Webhooks handle real-time events, but they miss anything that happened before the system existed. I built Airflow DAGs for bulk backfills: time-windowed queries pulling applicants created in the last hour, yesterday, this month, and a vintage window for historical imports. Semaphore-based concurrency control limits parallel SumSub API calls to avoid hitting their rate limits during bulk runs. Each DAG writes a failures CSV and a skipped CSV for audit trails.

Zendesk Sunshine Conversations: live chat widget. Built a C#/.NET 8 backend for a custom chat widget on top of Zendesk's Sunshine Conversations API. The interesting engineering challenge was file proxying: Zendesk stores agent-sent attachments behind auth-gated URLs that clients can't access directly. I built a proxy endpoint that fetches from Zendesk using backend credentials and streams the file to the client. Before any file reaches either side, it goes through a 4-stage pipeline: extension whitelist check, MIME header check, magic-number byte validation against a hardcoded signature dictionary per file type, and PDF content sanitization, a zero-dependency .NET implementation that decompresses FlateDecode streams, defangs embedded URLs, and neutralizes clickable /Link annotations.

Zendesk Ticketing API: automated ticket creation. A C#/.NET 8 service that automates ticket creation for the back-office team with multi-attachment support. The file validation pipeline runs extension whitelist, MIME type check, and magic-number validation in sequence; the magic-number check exists specifically to catch header spoofing where an attacker renames a malicious file to bypass extension checks. Wrote 25 xUnit tests covering validation edge cases and SonarQube security hotspot remediation. Includes a full Postman collection and developer reference documentation for the ABF team.

Observability and DevOps. Every service runs in Docker containers orchestrated with Docker Compose. Logs are shipped from all containers via Promtail into Loki, visualized in Grafana with custom dashboards. GitHub Actions CI/CD pipelines deploy to Ubuntu servers via SSH and to Windows Server environments via RDP runners, two completely different deployment targets requiring separate workflow configurations. Nginx organizes routing across the API, the webhook endpoint, and the admin interface with proper CORS headers per environment.

Cross-functional ownership. Beyond the code, I owned delivery end-to-end: weekly UAT sessions with compliance and product stakeholders, writing QA test scenarios that covered the KYC state machine edge cases, coordinating environment releases with DevOps, and documenting every API and webhook contract in Redocly. The compliance team went from manually checking SumSub daily to having a dashboard that's always current.

Mid-Senior Backend Engineer

PWR Labs

Dubai, UAE

01/2025 - 06/2025

PWR Labs is a Web3 startup building its own Layer-1 blockchain. I joined to architect the backend infrastructure for their ecosystem: a 170K+ client airdrop platform, an L1 network provisioning system, and analytics infrastructure tracking on-chain metrics. The tech stack was Java/Spark Framework across the board, which is unusually low-level for a startup: no Spring Boot, no ORM, everything was raw JDBC and manual SQL, which meant full control but also full responsibility for connection pooling, pagination, and query optimization.

Enterprise Airdrop Platform: 170K+ clients. The airdrop system was the company's main user acquisition engine. I built the full backend: a quest/challenge system where users complete social actions (follow on Twitter, join Discord, subscribe on YouTube, verify newsletter via Beehiive) to earn points. Quest completion is verified, not self-reported; Twitter actions are verified via the SocialData API against stored OAuth tokens, Discord membership via a JDA bot, Telegram via a TG bot. The quiz engine loads questions from a JSON configuration file, assigns point weights per question, and tracks completion with a scoring system. A leaderboard with pagination and admin CSV export sits on top, plus daily streak tracking via UTC-based scheduled tasks running in background threads.

OAuth integration complexity. Twitter requires OAuth 1.0a for user actions (posting, liking, commenting), a significantly more complex flow than OAuth 2.0 involving request token, access token, and HMAC-SHA1 signing of every API call. I stored the user's OAuth tokens post-authorization and used them for subsequent action verification, with a TwitterVerification helper that re-hits the SocialData API to confirm the action actually happened rather than trusting the client's claim.

L1 Network Provisioning System. The L1 Operator platform lets authorized users spin up new blockchain nodes. I built the provisioning flow: the backend calls Docker via a companion Python FastAPI service I also wrote, which handles Docker Compose orchestration with dynamic port allocation, with each new network node getting assigned available ports at runtime. The Java backend handles concurrent container deployment with timeout handling, S3 image uploads via the S3Helper for network configuration images, and RPC endpoint registration. A 3-level RBAC system (super admin, admin, operator) gates who can create networks, manage bridges, and view analytics, built with custom authorization middleware rather than a framework.

L1 Analytics Platform. The analytics service tracks blockchain metrics: transaction counts, gas usage, node expenses, unique wallet counts, daily active users, using Web3j integration with the PWR RPC endpoint. I contributed structured logging across all endpoints (every request gets a correlation ID), a production healthcheck endpoint for container readiness probes, dependency cleanup, and Docker compatibility improvements. PostgreSQL with HikariCP connection pooling handles the database layer, with indexing and pagination for high-read analytical queries.

Infrastructure and DevOps. All services deployed via GitHub Actions with multi-stage Docker builds, with separate build and runtime layers to minimize image size. PostgreSQL administered directly via psql CLI. DDoS protection via a custom rate limiter with concurrent request tracking and IP-based reset intervals. I managed Linux servers via SSH for deployments and database operations across dev, test, and production environments.

Mid-Senior Backend Engineer

Bearsight

Toronto, Canada

07/2024 - 05/2025

Bearsight is a Toronto-based startup building an event management and client engagement platform. The codebase used Python/Flask with a layered architecture: controllers, services, repositories, DTOs, and models separated cleanly, which I extended with new event and client workflows.

Event and client lifecycle management. Built the event creation and participation system: clients register for events, the backend tracks attendance state, and the system handles the full lifecycle from creation through completion. Authentication uses JWT tokens with bcrypt hashing via a custom cryptography helper. Repository pattern separates data access from business logic, with each entity (Client, Event, ClientEvent) having its own repository, service, and controller layer.

Twilio communications integration. Integrated Twilio's Messaging API for WhatsApp and SMS notifications at key event lifecycle moments: registration confirmation, reminders before events, and post-event follow-ups. WhatsApp delivery required configuring Twilio's WhatsApp Sandbox and handling the different message structure vs plain SMS.

Deployment and infrastructure. Application deployed on Heroku with Netlify handling the frontend static assets. Configured automated deploys from GitHub, environment variable management via Heroku config vars, and monitoring for dyno health and response times.

Mid-Senior Backend Engineer

Quantum Fintech Leap

Beirut, Lebanon

05/2023 - 01/2025

QFL builds white-label broker platforms for financial services clients. I owned the backend from architecture to production across two major systems: a broker portal and a SuperAdmin management platform. The tech stack was .NET/C# with Clean Architecture, CQRS via MediatR, PostgreSQL via Entity Framework Core, and real-time features via SignalR, all running on a multi-project solution structure with proper separation across Domain, Persistence, Infrastructure, and App layers.

Broker lifecycle management: the full picture. A "broker" in this context is a white-label reseller who onboards their own clients. The platform manages their entire lifecycle: KYC document upload with file type validation and repository pattern storage, MT5 trading account provisioning (I'm calling the MT5 API to allocate account credentials, set balance, assign server, configure main password and investor password, and set account type), deposit and withdrawal processing, card management with a verification/unverification flow, automated portal ID generation with CU/IB prefixes based on broker type, and reference URL generation for client onboarding links.

SuperAdmin system: 12 endpoints, 3-level RBAC. The SuperAdmin platform manages the brokers themselves. I built dual admin roles with ClaimCheck action filters that enforce View/Add/Update/Delete permissions per endpoint, not just role-based but permission-based at the action level. RoleClaimController lets admins assign or revoke individual permissions without touching role definitions. PropertyMappingService handles dynamic field mapping and sorting for data tables. The whole thing is backed by a PostgreSQL job store via Hangfire for background processing.

Security middleware stack: 5 layers. Every request passes through: HMAC-SHA256 request signing validation (the client signs requests with a shared secret; if the signature doesn't match, the request is rejected before it hits a controller), XSS payload blocking with 16 regex patterns covering script injection, event handler injection, and iframe injection, a 1 request/second throttle per IP, a 5-second timeout enforcer that kills long-running requests, and 3DES CBC encryption for sensitive field transmission. Symmetric and asymmetric encryption with salting and peppering protects stored credentials. All login events are logged with IP and geolocation tracking via audit interception.

OAuth and real-time features. Integrated 4 OAuth 2.0 providers (Google, Facebook, Microsoft, Twitter) via ASP.NET Identity with automatic broker profile initialization on first social login, where the system detects that a social user doesn't have a broker profile yet and redirects them through profile completion flow before allowing access. OTP/MFA confirmation via email for sensitive actions, refresh token rotation. Two SignalR WebSocket hubs: one for login event notifications (admins see when brokers log in), one for general admin notifications. Hangfire background jobs support 8 recurrence types (daily, weekly, monthly, quarterly, half-yearly, yearly, custom date, scheduler-triggered) with PostgreSQL persistence and a dashboard at /jobs.

Financial transaction system. 10 transaction handlers covering deposit, withdrawal, approve, decline, user and broker aggregations, type-filtered lists. 8 wallet transaction handlers for add, accept, reject, cashout, update, delete, broker aggregations, and financial reporting. Entity Framework Core audit interception runs across 50 entities and 35 DbSets, every create/update automatically stamps who did what and when, with global soft-delete query filters so deleted records are hidden from normal queries but preserved for audit.

Team leadership. Mentored 3 junior developers through structured code reviews, established PR templates with required checklists, enforced SOLID principles and separation of concerns in every review cycle. Translated stakeholder requirements into technical specifications via Jira and ClickUp, ran edge case testing sessions before every production release.

Junior Full Stack Developer

BTB Markets

Beirut, Lebanon

01/2022 - 04/2023

BTB Markets is a forex brokerage. This was my first production role, where I built two full-stack applications from scratch, both live and serving real users. The stack was Node.js/Express on the backend, React on the frontend, MongoDB and MySQL for different data needs, and MT5 for live trading data.

Investor Relations Platform (IRP). A platform where BTB's clients could access live market data, economic calendars, and market reports. I built the backend routes (market data, assets, news, reports, subscriptions, company, user management, admin panel) and integrated MT5 to pull live OHLC data for 8 currency pairs. Real-time price updates came via WebSocket connections to MT5, with the backend acting as a relay. MySQL stored user data and subscription state; MongoDB stored market reports and news content. Subscription management included early-bird pricing logic, invitation and referral tracking, and automated emails for subscription events (expiry warnings, renewal confirmations, credential delivery). Both systems deployed with SSL certificates and rotating log files.

Prop Trading Challenge Platform. A platform where traders could enter funded trading challenges. I built the phase-based lifecycle: a trader registers, gets a demo MT5 account, and trades for a defined period. The backend pulls their trade history from MT5 in batch, calculates their maximum drawdown and win rate, and automatically evaluates pass/fail. Real-time balance tracking via WebSocket keeps the dashboard current during the challenge period. Discord and Twitter integrations for community announcements, newsletter integration for challenge updates.

Authentication and payments. 3-level RBAC (public, authenticated user, admin) with JWT token management and Google OAuth 2.0 for social login. Payment integrations with 2Checkout and MyFatoorah, handling webhook callbacks for payment confirmation, subscription activation, and failed payment handling. Email infrastructure with SMTP and templated notifications across the full user lifecycle. Scheduled background jobs cleaned up expired sessions and synced MT5 data on regular intervals. React-based admin panel for managing users, content, and platform settings.

About Me

System Integrations

Reads

System Design Boot

Experience

Mid-Senior Backend & Integration Software Engineer

Mid-Senior Backend Engineer

Mid-Senior Backend Engineer

Mid-Senior Backend Engineer

Junior Full Stack Developer

Get In Touch