Eric San
Security-Focused Senior Full-Stack Engineer
Singapore Citizen · ericsssan@gmail.com · github.com/ericsssan · linkedin.com/in/ericsssan
Summary
Security-focused senior full-stack engineer with 10 years of remote experience building web products for client companies across Europe. I work where security and compliance are contract requirements rather than afterthoughts: GDPR obligations, threat modeling before sprint planning, recurring third-party penetration tests, and I own the cryptography and architecture behind them. I develop agent-first, and on my side projects I build open-source tooling: type checkers, static analyzers.
Technical Skills
Security & Compliance: End-to-end encryption (E2EE), zero-knowledge architecture, defense in depth, cryptographic primitives and key management, Secure SDLC, threat modeling, third-party penetration-test remediation, security questionnaires and vendor due diligence, GDPR, data minimization and retention
Languages: TypeScript / JavaScript, Python, PHP, Rust, Zig, Go, SQL
Frontend: React, React Native (Expo), Next.js, Vue.js, Tailwind CSS, Flutter
Backend: Django, Django REST Framework, Laravel, Node.js
AI / LLM: Retrieval-augmented generation (RAG), vector search, Gemini
Agentic Dev: Claude Code, agentic coding workflows, parallel git worktrees, MCP servers, multi-agent code review, spec-driven implementation
Cloud & Infra: Azure (AKS), Google Cloud, AWS, Supabase, Kubernetes, Docker, Terraform, Nginx
Data & Queues: PostgreSQL, pgvector, MySQL, Redis, Celery
Testing: Playwright, Vitest, Jest, pytest, PestPHP
Observability: New Relic, Datadog, Sentry
Education
B.Eng. Computer Engineering — National University of Singapore
Professional Experience
Full-Stack Engineer → Senior Full-Stack Engineer (current)
Delivering full-stack products for client companies across Europe.
- Built encryption-first features for products handling sensitive user data, owning the client-side cryptography and key-handling design.
- Own web-side remediation for recurring third-party penetration tests, closing authentication and session-handling findings each cycle.
- Set security requirements at design time through team threat modeling ahead of each sprint, and supplied the engineering answers behind customer security questionnaires, enterprise due-diligence reviews, and the company's ISO 27001 certification effort.
- Delivered client products across healthcare, sales, and assessment, owning architecture, code quality, and CI/CD from first commit through production.
- Traced and fixed the query patterns behind slow reporting endpoints on data-heavy products, using indexing, query restructuring, and pre-computation to hold response times steady as datasets grew.
- Modernized legacy client applications onto maintained frameworks, including production data migrations off legacy PHP.
- Review teammates' pull requests with an agent-assisted workflow, verifying each finding against a runnable harness and holding implementations to defense in depth rather than a single point of control.
Selected Projects
AssetPass — A digital-legacy platform where data is encrypted on the client and never readable by the server. I re-architected the client-side encryption into an isolated vault package running in a Web Worker, keeping key material off the main thread, and hardened the encryption and authentication code alongside a significantly stricter Content-Security-Policy. Next.js, React, TypeScript, Web Crypto API, Argon2id (WASM), WebAuthn/passkeys.
Jarvis Asset — A production RAG platform that turns a fund's research archive into a conversational assistant. I build it across the stack: a microservices backend with hybrid retrieval (semantic + keyword search, reranked), automated document ingestion, encryption and hardened auth, plus a mobile client. Go, Python, React Native, Supabase/pgvector, Gemini, GCP.
Asentaa SaaS Platform — A multi-tenant candidate-assessment SaaS platform; I rebuilt it from a legacy on-site tool, reworking the scoring engine and migrating existing data. Laravel, React, Tailwind CSS.
SalesGoal — A sales-management platform for pipeline tracking, performance analytics, and revenue forecasting. I built its drag-and-drop pipeline boards and data-visualization dashboards. Laravel, React, TypeScript, visx, Playwright.
KeyForCare Analytics — A patient-feedback and quality system for healthcare providers; I automated the report generation and distribution pipeline with caching and pre-computation, with respondent contact data encrypted in place and wiped after each survey cycle. Vanilla PHP, Laravel, MySQL, Redis.
Open-Source Projects
Side projects, built from scratch to learn compiler, analysis, and protocol internals; experiments rather than production libraries. Agent-first: one coding agent per issue across parallel git worktrees, gated on differential-test harnesses over the reference conformance suites.
A TypeScript toolchain in Zig
- ez — high-performance JS/TS parser + linter with a zero-copy ESLint plugin runner: run any ESLint plugin (core,
n,es-x,import) against the Zig AST without reimplementing a single rule. - ez-checker — a from-scratch reimplementation of the TypeScript type checker (the type-system core of
tsc) in Zig: full inference, control-flow narrowing, conditional/mapped/utility types. ~83% TypeScript-corpus conformance. - es-parser — the fast, standalone JS/TS/JSX parser the toolchain is built on; SIMD lexer, struct-of-arrays AST; 3,966/3,966 test262.
Static analysis & performance