BHASKAR PANDEY AI & Automation Solutions Engineer Houston, TX | bhaskar.knp@gmail.com | linkedin.com/in/pandeybhaskar | github.com/thebpandey --- SUMMARY AI and automation solutions engineer with over a decade of enterprise network and security engineering at Rackspace, Epicor Software, and World Wide Technology. Solo-built and launched an AI learning platform now serving 34 active members, a retrieval-augmented knowledge system, and a multi-agent delivery toolchain used by LearnStack OS community members. Previously led the team securing global data center infrastructure across five continents, and delivered client-facing solution design under PCI-DSS and HIPAA constraints. Works the full arc from discovery interview through architecture, implementation, and handoff. Three independent client engagements delivered under Almora Technology, LLC. --- TECHNICAL SKILLS AI and LLM systems: Prompt engineering, structured extraction with schema validation, human-in-the-loop workflow design, multi-agent orchestration, model and reasoning-effort routing, versioned prompt and parser metadata, provenance and evidence tagging, prompt-injection defense, Claude API, OpenAI, OpenRouter, Model Context Protocol AI-assisted engineering: Claude Code and Codex as primary development environments; spec-driven development, multi-agent orchestration, model and reasoning-effort routing, file-ownership isolation, automated code review and acceptance gating. Builds the orchestration tooling, not only a consumer of it. AI engineering practice: Harness engineering, graphs and loops, agent context and memory engineering, MCP server and API creation, multi-agent orchestration, prompt engineering, advanced knowledge of Anthropic and OpenAI models, multi-modal agent experience, custom AI agent deployment using Hermes Agent and n8n Languages in shipped systems: TypeScript, JavaScript, Node.js, Python, SQL, Shell Frameworks in shipped systems: Next.js, React, Docusaurus, Drizzle ORM, Better Auth, Vitest, Playwright Data layers built and operated: PostgreSQL, Neon serverless Postgres, Supabase, Upstash Redis, pgvector, Drizzle migrations, Beads and Dolt versioned issue history Infrastructure and delivery: Vercel (Blob, Workflow, hosting), GitHub Actions, GitHub Pages, Git worktrees, CI with integration tests and secret scanning, checksum-signed release automation, Ubuntu Server, systemd, Tailscale, OpenSSH Enterprise networking and security: Cisco ASA and ASA-X, Palo Alto, SonicWALL, pfSense, Untangle; F5 BIG-IP LTM, GTM, ASM, VIPRION and iRules; Brocade ServerIron ADX; Cisco Nexus, Catalyst, ISR and ASR; Cisco ISE and TACACS; IPsec IKEv1 and IKEv2 site-to-site VPN, AnyConnect SSL VPN, RADIUS and LDAP two-factor integration; SSL and TLS cryptography, CSR, SAN and EV certificates; TCP/IP and HTTP troubleshooting; BGP, MPLS and DMVPN Compliance and governance: PCI-DSS, HIPAA, firewall configuration management and change control, vendor management, RFP authoring, IT budgeting and cost analysis, threat modeling, fail-closed authorization --- SELECTED AI AND AUTOMATION WORK LearnStack OS | AI learning platform, 34 active members Sole founder, architect, designer and implementer. Next.js 15 App Router, Supabase, Vercel, pnpm. — www.learnstackos.com - Built and launched the full platform end to end: product definition, information architecture, visual design, database schema, application code, content pipeline and all user-facing copy. 34 active registered members. - Designed the interface as a retro desktop operating system. Persistent windows, a desktop shell, and window state that survives route navigation give learners a familiar working metaphor instead of a scrolling course page. - Built the AI backbone on retrieval over a chunked content corpus, driving placement assessment, personalized learning paths, and in-lesson prompt tooling. - Runs multimodal agent pipelines for text and image generation. An Article Creation Wizard and a companion Discord bot generate from a single canonical writing and research specification, so output stays consistent across surfaces. - Implemented entitlement-gated monetization: a free tier with daily lesson drip, a premium tier that removes drip and unlocks gated courses, articles and community channels, with automated leak-gate tests guarding the premium boundary. - Administered image styles through explicit lifecycle states (draft, test, publish, archive, retire) and ran transactional mail through a verified SMTP sender with rate-limit handling. BrainVault | Retrieval-augmented knowledge platform Sole architect and implementer. Private repository. Supabase, pgvector, edge functions, OpenAI embeddings, Cloudflare Tunnel. - Built a second-brain system that solves ingestion, organization, semantic search and retrieval over a personal knowledge corpus, with a local vault as source of truth and Supabase as the retrieval sync target. - Routed every capture channel through a single edge-function front door, so all inputs inherit the same LLM extraction and data-domain safety rules rather than each channel reimplementing them. - Implemented retrieval on pgvector using OpenAI text-embedding-3-small at 1536 dimensions, stripping operational frontmatter before embedding so metadata never pollutes the vector space. - Enforced fail-closed data governance: the privacy domain is an explicit caller parameter, never inferred by a model, defaults to private, and is never auto-promoted to public. - Hardened the deployment: internal APIs bound to loopback with a Cloudflare Tunnel as sole public ingress, a hard failure on missing auth secret rather than a silent insecure start, and a mass-delete guard against bulk data loss. - Benchmarked local Qwen vision and embedding models against hosted providers, and centralized model identifiers in one configuration module so provider retirements cannot break the pipeline in five places at once. Real Estate Closing Document Automation | Client engagement, Texas real estate law firm Solutions engineer and sole implementer. Private client repository. Next.js, TypeScript, PostgreSQL, Drizzle ORM, Better Auth, Vercel Blob, Upstash Redis, Vercel Workflow. - Ran the discovery and requirements session with the attorney principal, then mapped the manual process into a ten-stage automated workflow from secure intake through extraction, classification, conflict detection, generation, attorney review and delivery. - Designed the AI boundary as fail-closed. Attorney-approved templates and deterministic rules control all legal language, model output is treated as untrusted, and every extraction run records provider, model, prompt version, schema version and parser version. - Built the deterministic form-selection engine, which rejects unknown or conflicting facts and blocks finalization of an incomplete packet rather than guessing. - Implemented multi-tenant security: tenant isolation, database-backed sessions, typed permissions, rate limits and fail-closed authorization. Intake validates file signatures and resource limits, deduplicates with SHA-256, and stores sources privately on immutable object paths. - Authored the formal threat model covering cross-tenant exposure, prompt injection, malicious uploads, sensitive logging, hallucinated facts, credential compromise and AI-provider data handling. - Shipped verticals carry 66 unit tests, 21 PostgreSQL integration tests and Playwright browser checks, behind CI running type checks, migrations, production builds and Git-history secret scanning. Project Kickoff and Agent-Team | AI-native software delivery system Agent-Team v7.1.0 and Project Kickoff v0.4.0: source public on GitHub under a custom license for LearnStack OS members. Agent-Team Lite v6.1.0 is the MIT-licensed open-source edition. September 2026. - Two paired systems covering the full lifecycle: Project Kickoff defines what gets built, Agent-Team controls how it is implemented, reviewed, integrated and released. - Project Kickoff runs a five-stage guided decision process across product, first-release scope, user experience, architecture and execution, using one-question discovery, explicit approval gates, targeted invalidation when a decision changes, and resumable checkpoints. Emits stable requirement IDs, tracker mappings and duplicate-safe task seeding. - Agent-Team decomposes an objective into bounded workstreams and routes each to a specialist agent (orchestrator, developer, code reviewer, visual reviewer) with a bound model and reasoning-effort level, so cost and capability are matched to task severity rather than flat-rated. - Enforces file-ownership controls and Git worktree isolation so parallel agents cannot collide, then drives review-remediation cycles, acceptance gates and a final reconciliation pass. - Provides durable run status, pause and resume, recovery evidence, checkpoints, telemetry, lifecycle hooks and fail-closed policy handling. - Release automation builds host-specific archives, validates packages, generates SHA-256 checksum manifests and publishes versioned releases. Kickoff v0.3.0 verified by 36 integrated tests across 31 runtime files. Self-hosted AI and remote-access infrastructure - Operates a Tailscale-connected estate across Ubuntu Server, macOS and Windows hosts, with persistent agent services under systemd and remote access over SSH and RDP. - Diagnosed and repaired a tailnet path failure using `tailscale debug rebind` and `restun`, validated against two SSH endpoints and one advertised HTTPS route. Additional open-source work (MIT) Agent-Team Lite, Write Like a Human, Context Summary, Session Detail, Sensible Mode, Is This a Good Idea, and ADL (a deployed Docusaurus and React compatibility platform on GitHub Pages with GitHub Actions CI/CD and 18 required test scenarios). --- PROFESSIONAL EXPERIENCE Almora Technology, LLC | Houston, TX Founder and Solutions Engineer | 2020 - Present Independent AI and automation consulting. Delivered engagements for three clients. - Texas real estate law firm (Austin, TX): legal document automation platform, detailed above. Owned discovery, workflow analysis, threat modeling, architecture, and implementation. Client reference available on request. - Parcyl.ai / Syndnet Corp (Austin, TX): product advisory for an AI site-intelligence and parcel-data platform. Ran consultation sessions covering product design, product direction, target audience definition, and feature prioritization. The engagement led to an invitation to join the company as growth officer and technical advisor. - DPA Summit: resolved a set of production failures that were blocking revenue. Diagnosed and fixed SSL certificate failures, restored a checkout funnel that was unreachable for a subset of users, and remediated site trust and reputation problems that were causing ISP content and security filters to block access. - Standing design pattern across engagements: deterministic rules and approved templates govern any output with legal or financial consequence, while the model handles extraction, classification, and drafting under human review. Builders Land Source (Property Revival Specialists, LLC) | Houston, TX Founder and Technical Lead | January 2022 - Present Built and operated an internal data and research platform. - Designed a 395-field master data model. - Produced a ZIP-to-MSA crosswalk of 42,724 rows by joining HUD USPS and Census CBSA delineation files, giving every record a consistent market key. - Generated TypeScript interfaces and utility functions against a property-data API to type the ingestion layer. - Consolidated multi-source contact records into a single CRM pipeline. World Wide Technology | Remote, Central Region Senior Engineer, Professional Services and Delivery Services | November 2017 - May 2022 - Client-facing delivery engineer across the full engagement arc: requirements definition, solution design, pre-sales support, project kickoff, implementation, and cutover. - Delivered Palo Alto policy management, F5 VIPRION code upgrades and new builds, Cisco ASA deployments, code upgrades and migrations, and site-to-site VPN tunnel migrations. - Executed Nexus data center refreshes, core, distribution and access switch upgrades, and branch office integrations over MPLS, BGP and DMVPN. - Deployed Cisco ISE as TACACS, and built lab-as-a-service environments to emulate customer production for pre-change validation. - Managed on-site delivery teams and vendor relationships, and carried on-call responsibility for network and security outages. Epicor Software Corporation | Austin, TX Senior Network Engineer, Team Lead and Interim Manager, Network Engineering | April 2016 - October 2017 - Led the team responsible for perimeter access control across more than 60 firewall pairs in 35 locations worldwide, spanning data centers on five continents. - Served as tier-3 technical lead and escalation point for a 12-engineer tier-1 and tier-2 team, and directed offshore consulting engineers. - Designed the configuration management and change-control process for firewall configurations, then reviewed and approved proposed changes against it. - Owned application delivery on F5 BIG-IP LTM, and advanced Cisco ASA and SonicWALL configurations for site-to-site VPN, SSL and IPsec remote access with RSA two-factor authentication. - Onboarded new customers by defining VPN and PCI requirements up front to keep environments compliant. - Owned procurement, license management, vendor relationships, RFPs, IT budgeting and cost analysis; built the training program that moved tier-2 engineers up the stack. Rackspace | San Antonio, TX Network Security Engineer | January 2014 - April 2016 - Ran pre-sales and implementation calls with new customers, gathering requirements and delivering customized solutions aligned to compliance and best practice. - Built custom network security policies on Cisco ASA and ASA-X to restrict access, protect availability, and hold PCI-DSS compliance for hosted customer environments. - Implemented application delivery on F5 LTM and Brocade ServerIron ADX, including application-layer packet flow control through iRules and content-switch policies. - Performed vulnerability assessments, patched to mitigate threats, supported load testing, and mitigated DDoS and other live attacks against customer infrastructure. - Prepared and executed hardware migrations and upgrades inside planned maintenance windows across Rackspace data centers and OpenCloud, and resolved SSL, TLS and certificate validation failures across customer hosting. Earlier Experience Network Systems Engineer | San Antonio Water System | San Antonio, TX | July 2011 - December 2013 Cisco routing and switching estate, Cisco WLC indoor wireless and an outdoor long-range PTP and PTMP radio network, monitored through SolarWinds Orion, Splunk and NetBrain. --- EDUCATION Bachelor of Science, Engineering Science | St. Mary's University, San Antonio, TX | 2002 - 2007 Graduated with Honors. Completed additional elective coursework on the Computer Engineering track. Dr. Turgut Ozan Engineering Student of the Year Award, graduating year. 3.5 cumulative GPA. --- CERTIFICATIONS Google Cloud Generative AI Leader | Google Cloud certification | Certified September 18, 2026 Previously held: Cisco CCNP Routing and Switching, CCNA Security and CCNA; F5 301 CTS LTM, 201 TMOS Administrator and 101 Application Delivery Fundamentals; CompTIA Network+; AWS Certified Cloud Practitioner