Software, AI, and cloud engineering

Live audio is transcribed, translated, and synthesized as Spanish speech in one streaming pipeline. Veravox applies this approach to long-form, one-way translation and currently runs in production.

Turn contracts, records, manuals, and email into something a team can actually query. Extraction, classification, and retrieval wired into the systems people already use, rather than a separate tool nobody opens.

Meetings, calls, and lectures converted to accurate, searchable text, with structured summaries routed wherever they need to land.

Assistants grounded in approved documentation so responses can cite their sources. Retrieval and evaluation are scoped to improve accuracy and surface unsupported output.

Choosing the right model for the job, measuring whether it is actually working, and building the fallback path for when it is not.

Terraform with remote state, so environments are reproducible and every change is reviewable. No hand-clicked consoles, no configuration that exists only in somebody’s memory.

Lambda and API Gateway where traffic is spiky, ECS where workloads are steady. Chosen on the shape of the problem rather than fashion, because the difference shows up on the monthly bill.

CloudFront with origin access control, TLS requirements, and managed security headers to improve delivery performance and restrict direct origin access.

Cognito for authentication with external identity providers, and scoped IAM roles with explicit least-privilege policies for everything else.

CloudWatch metrics and structured logs with defined retention, so you can answer what happened and what it costs without guessing.

Moving existing sites and applications onto managed infrastructure with a documented cutover and a rollback path. The migration plan is tailored to the current application and its operational constraints.

Pixel-controlled apps built for a specific task and a specific screen size. The right choice when the workflow is opinionated and the interface needs to match how people actually work, especially on tablets and phones in the field.

Applications generated from the data model, with the security roles, forms, views, and business rules coming from Dataverse. The right choice when the data relationships are complex and consistency matters more than bespoke layout.

Tables, relationships, business rules, and role-based security designed properly up front because the data model drives the behavior of a model-driven app.

Approvals, notifications, document routing, and scheduled jobs connected across Microsoft 365 and outside systems, with error handling that surfaces failures instead of swallowing them.

Dashboards and paginated reports built on a clean semantic model, so numbers reconcile and nobody maintains a shadow spreadsheet.

Form processing, prediction, and classification added to existing flows and apps where a full custom model would be overkill.

Media, events, and publications syncing automatically from the sources you already use. On the Kress build this replaced weekly manual editing with three pipelines and a 90-day forward scheduling horizon.

Payload budgets, image pipelines, compression, and caching strategy treated as part of the build. Our Kress Memorial reference build has recorded a 100 Lighthouse score across performance, accessibility, best practices, and SEO.

Semantic structure, keyboard paths, focus management, and contrast checked against WCAG AA. This matters both ethically and because public institutions are frequently obligated to it.

Structured data, canonical URLs, sitemaps, and metadata built into the templates so search engines can read the site the way users do.

Forms with real spam defence, attribution tracking, and routing into whatever the team already checks, such as email, a CRM, or a queue.

Credentials are managed in AWS Secrets Manager and injected at runtime rather than stored in application code, the repository, or shared documents.

Scoped IAM roles with explicit policies, so a compromised component cannot reach past what it legitimately needs.

TLS 1.2 as the minimum, HSTS, managed security headers, origin access control, and storage with public access blocked at the account level.

reCAPTCHA Enterprise plus server-side validation on public forms, so scoring happens where it cannot be bypassed by skipping the browser.

Application and access logs with defined retention, so there is an answer when someone asks what happened and when.

Where the data justifies it: WAF, Content-Security-Policy, customer-managed encryption keys, tightened retention, and selecting only BAA-eligible services. Scoped per engagement rather than promised as a blanket certification.