Arda Karaduman

• Principal author of Veltra's MCP + OAuth 2.1 platform, exposing the travel-activity catalog to AI assistants (Claude MCP Apps and ChatGPT Apps) and giving staff internal AI tooling.
• Built a standards-compliant OAuth 2.1 / OIDC authorization server in Python/FastAPI — PKCE, RS256 JWKS, refresh-token rotation, PAR / revocation / introspection, dynamic client registration, Google Workspace SSO and RBAC — on a clean, hexagonal architecture.
• Built a stateless 'activity search' MCP server dual-compatible with Claude and OpenAI app hosts — approved by Anthropic and now publicly listed in the Claude connector directory — plus internal Google Analytics and AWS read-only MCP tools.
• Migrated image delivery from a paid CDN to a self-developed solution on AWS CloudFront.
• General application and infrastructure architecture and planning across Python, Go and Node services, deployed on AWS ECS with Terraform and GitHub Actions CI/CD.
• Acted as bridge engineer between the overseas and Japan teams, and led MCP integration of legacy systems.

• Senior backend engineer and a top-3 author on the Go (Echo / GORM) API of WareX, a production logistics 'warehouse-exchange' SaaS (the company incorporated as Gaussy in 2022).
• Owned the warehouse (geo + license-filtered search), contract, workspace, document and price-specification resource verticals end-to-end — data models, REST resources and migrations.
• Built role-based access-control middleware and server-side mass-assignment guards, with systematic request validation and parameterized queries.
• Owned a large share of the integration-test suite, including the shared test harness the rest of the team's API tests run on.
• Database migration and seeding (goose) and Bugsnag error reporting; third-party integrations including Hubspot and Mailgun.
• Deployed on Google Kubernetes Engine via CircleCI with SOPS-managed secrets; some frontend work on the Vue/Nuxt admin and customer portals.

• Lead author of a multi-tenant Rails 5 JSON:API + React platform delivering fund and bond analytics (net-asset-value graphs, factor analysis) to users as LINE Flex Messages and generated charts.
• Implemented LINE webhook HMAC signature verification, strong-parameter authorization across all controllers, and bcrypt-secured authentication.
• Built a solo Go service fronting a pool of text-to-speech servers — race-free by design (channel-owned state), with PCM-to-MP3 transcoding, content-digest caching and per-host load distribution, validated with `go test -race` in CI.
• Built a Go AWS Lambda ingesting daily Reuters DataScope Select market data into an idempotent DynamoDB/S3 state machine, and extracted an MIT-licensed Reuters DSS Go client library.
• Mature CI/CD: CircleCI build-and-deploy with Docker images pushed to AWS ECR and tag-gated releases.

• Sole author of an end-to-end Go daemon for in-store edge devices (amd64 and ARM) — staff counting via BLE beacons, repeat-customer counting via WiFi sniffing, and face recognition — with a web configuration UI.
• Built its full over-the-air update pipeline: cross-compiled amd64/armhf, built signed Debian packages, pulled build secrets from HashiCorp Vault, GPG-signed releases, and published to an S3 apt repository with testing/release channels.
• Lead author of a FAST-ED stroke/cardiac triage API for hospitals (Ruby/Grape + GraphQL + Pundit) with API versioning, HMAC request signing, and bcrypt auth with login lockout and rotating keys.
• Co-built the triage admin SPA (Vue 2 + Apollo) deployed to AWS S3/CloudFront, and contributed sensor-vendor drivers to a multi-tenant Go ingestion daemon.
• Extracted reusable Go libraries to my own namespace; CI/CD with GitLab CI and Docker.

• Backend engineer on the live Ruby/Padrino backend of 'Griffon', a published mobile MMORPG (Japan + Korea/Naver) in a ~60-engineer codebase.
• Independently owned the achievements, friendship, reward-distribution and guild-battle matchmaking systems end-to-end — data model, typed-RPC service, master-data importer, migrations and tests.
• Designed database-level idempotency via unique indexes and wrapped multi-step in-game economy mutations in transactions.
• Built a structurally mass-assignment-free typed-RPC API with server-side authorization, validated by branch-complete RSpec suites.
• Worked in an Agile environment with tight deadlines on a game with thousands of daily active users.

• Co-led (primary author) a Ruby usage-metering and billing batch for a mobile Backend-as-a-Service platform — aggregated per-app API/storage/analytics usage from a 3scale API gateway, computed plan overages, and reported billable usage to Zuora with idempotent create-or-update reconciliation.
• Tested with RSpec, Minitest and serverspec; packaged as an Omnibus/RPM cron job.
• Built and operated the Varnish + 3scale API-gateway metering layer and the Puppet modules (VCL/Puppet) that deployed the billing and gateway stack.
• Payment integration via Zuora and PayPal; usage tracking and logging with 3scale, Varnish and fluentd.
• Developer-portal development (Ruby on Rails, Backbone.js) and Cloud Code maintenance (Node.js); wrote the team's first Go code (an early Kii Go SDK).
• Various automation: reports and AWS resource tuning in Ruby/Bash with Puppet.

• Sole build-and-release / cloud-infrastructure engineer for AppExe, a white-label no-code mobile-app builder that generated native iOS/Android apps.
• Built the on-demand native build service that turned no-code app definitions into signed native APKs (Ruby/Sinatra, with a Python predecessor).
• Authored full server-stack provisioning with Puppet + Vagrant (dual VirtualBox/AWS): GlassFish, PostgreSQL, MongoDB, log shipping and firewall, plus the Android/iOS build, release and backup scripts.
• Built a per-customer AWS account/instance activation control plane and a versioned S3 release-delivery tool.
• Automated AWS account signup end-to-end with a Selenium-driven pipeline, and ran the team's git server.
• Designed scalable EC2 infrastructure with monitoring and auto-scaling.

• Backend development for Ryde services (Mobile and Web) using Ruby on Rails and GraphQL.
• Some frontend development (Admin site, Ruby on Rails, React).

• Part-time open-source contributor to IronFunctions, an early Docker-based serverless (FaaS) platform (later the Fn Project).
• Contributed to and helped maintain the IronFunctions web UI (Express + Vue) as a top-3 author — added JWT authentication and the CI/CD Docker release pipeline.
• Contributed features and fixes to the Go FaaS engine, including a payload-as-stdin runner and a dependency-management migration.
• Wrote example serverless functions in Go, Node and Ruby to dogfood the platform.

Graduate research at the Amano Laboratory (computer architecture / embedded systems / VLSI). Completed the Master's in 2008 and continued PhD-level research through 2011 — four first-author peer-reviewed papers on the "Echo instruction," a hardware code-compression technique implemented in Verilog on a MIPS R3000 core and synthesized to 90nm silicon — before moving to industry.

Selected Papers:

• 2011Cache Implementation for Echo Instructions on an Embedded Processor (IPSJ Transactions on System LSI Design Methodology, T-SLDM)
• 2009Code Compression with Split Echo Instructions (IEICE Transactions on Information and Systems)
• 2009Design and Implementation of Echo Instructions for Embedded Processors (Embedded World Conference, Nuremberg, Germany)

Dissertation on parallel simulation of quantum circuits on Linux clusters (MPI) — implementing the QFT, Grover and Shor algorithms with a distributed state-vector simulator.