# Maksym Smovziuk — Engineering Lead & Platform Architect > Engineering lead and platform architect, 19 years in production: React, Node.js, AWS, Kubernetes and AI agents. Built the platform 5,000+ customers use daily. Website: https://smovziuk.com/ **I build platforms teams ship on.** 19 years shipping production software. Hands-on architect — React, Node.js, AWS, Kubernetes, AI-assisted delivery. ## Key numbers - 19 yrs in production - 20+ services on EKS - 100+ projects shipped - 100% Upwork feedback ## One platform, not a pile of apps. The shape of what I run in production: 20 services on Kubernetes behind a WAF, shipped through GitOps, SaaS on the edges, managed data underneath. It heals itself: four AI agents watch errors, infrastructure, databases and releases, find the cause and fix it before anyone gets paged. ## Agent = model + harness. Models are interchangeable. The harness around them is not: what the agent knows, what it can touch, what it must never do, how it proves the work is done, and how it learns from every run. I build that harness for my team, run agents as a team of their own, and keep judgment on top: what's worth building, what we must not break. ### Context What the agent knows: conventions, architecture, past decisions. Loaded every session. (AGENTS.md · rules · memory) ### Tools What it can touch: MCP for docs and knowledge, CLI and REST with narrowly scoped tokens for Jira, Sentry and git. (MCP · CLI · scoped tokens) ### Skills How it works: reusable playbooks for migrate, review, ship and triage. (.claude/skills/*) ### Guardrails What it must not do: dangerous commands are denied, cluster access is read-only, and agents never merge. A PR assigned to a human is the gate. (deny hooks · read-only RBAC · kill switch) ### Feedback loops How it knows it is done: types, unit and e2e tests, a pentest of the new surface and evals close the loop before a human looks. (tsc · unit · e2e · pentest · evals) ### Orchestration Who does what: each task goes to the skill that owns it, reviews fan out to isolated lanes, a skeptic tries to disprove every finding. (route → fan-out → verify → loop) ### Self-learning How it gets better without retraining: every fix writes an incident memory, human review comments become gotchas, and a nightly pass promotes repeated lessons into rules and skills. When an agent does something it shouldn't, we fix the harness, not the prompt. (memory · gotchas → rules · nightly consolidation) ## From hardware tech to platform owner. ### EU Engineering Lead & Platform Architect · On Q Property Management Oct 2021 — now, Remote, EU Turned a PHP/jQuery system into the platform a 200-person company and 5,000+ customers run on every day. Built with a team of five I hired, and shipped automatically every day instead of by hand when needed. - Hired and lead the EU team: five engineers including me. Architecture review happens early, while changing course is still cheap. - Rebuilt the property-management system as React, Next.js and Node.js on AWS without stopping the business, and now move the company off Salesforce the same way, one piece at a time. - Releases used to be manual and on demand. Now every repo ships through one pipeline, automatically, every day. - 20+ services on EKS for 200 employees and 5,000+ customers: portals, SSO, e-sign, scheduling, communications, accounting, files. - An AI ops agent works around the clock: turns errors into fix PRs, reviews PRs until clean, updates packages, runs security, cost and code audits. About 90% of its PRs get merged, because the rules it works by are tuned. - Own security and cost: WAF, Security Hub, least privilege, fail-closed auth; AWS bill down about 30%. Stack: React, Next.js, Node.js, AWS, EKS, MongoDB, Salesforce, Claude Code ### Senior Software Architect · Upwork · Top Rated Apr 2018 — Dec 2022, Remote Architect and full-stack JavaScript developer for English-speaking clients. Top Rated (top 3%), 15+ completed projects, 100% positive feedback. - Ran the technical side end to end: scoping, contracts, estimates, Agile/Kanban with the client, teams of up to five. - Greenfield and rewrites in React, React Native and Node.js; REST and GraphQL APIs; OAuth and JWT. - Stabilized and migrated legacy JavaScript/PHP systems without stopping the business; Salesforce API integrations. - DevOps on AWS: CI/CD, serverless, Docker, Amplify, CDN, Nginx. Stayed on for support, not a handoff. Stack: React, React Native, Node.js, GraphQL, DynamoDB, AWS ### Co-founder & CTO · Jupser Apr 2018 — Nov 2019, Kyiv Built a software company from scratch with a partner and stayed in every part of it: sales, hiring, mentoring, delivery and architecture. - Led teams of up to 15 and was the main client contact; negotiated about 80% of the contracts personally. - Hands-on full-stack: React, React Native, Node.js and WordPress, plus legacy systems we kept alive and improved. - Data architecture across MySQL and MongoDB; DevOps on AWS; security and performance reviews; payment and social integrations. Stack: React, Node.js, MongoDB, MySQL, AWS ### Senior Software Engineer · Jaybird Group Aug 2014 — Apr 2018, Ukraine Senior full-stack JavaScript and PHP developer at an outsourcing shop running many products at once. Shipped 100+ projects of every size. - Designed project and database architecture, wrote the API docs, stayed on through integration and support. - React, Node.js, first React Native and PWA work; Phalcon, Yii and Symfony; WebSockets and maps. - Became the team's DevOps person: AWS certified, Linux, CI/CD. Built a MERN boilerplate so new projects started faster. Stack: React, Node.js, PHP, MongoDB, AWS ### Senior PHP Developer → head of the PHP team · EGO Creative Innovations Jul 2011 — Aug 2014, Ukraine My first real team job: clients in English every day, and sites taken from idea to production. - Zend Framework and Phalcon apps; custom WordPress and Drupal themes and plugins. - Stores on OpenCart and Magento with payment gateways; responsive front ends and early mobile UX. - First SysOps steps: LAMP on dedicated servers, Nginx, Bash; hybrid apps in Cordova. Stack: PHP, Zend, MySQL, WordPress, Magento ### Hardware technician → PHP developer · InterComputerF · tehnoart · abz agency Nov 2007 — Jul 2011, Ukraine Started repairing computers and taught myself PHP by building the company's first website. - Ran a live online store: shop CMS, theme fixes, and parsers that kept stock and prices current. - Rewrote the importer as a threaded C#/.NET desktop app; then custom sites at an agency. Stack: PHP, MySQL, jQuery, C# ## Things I built and run in production. One platform, 27 systems, a small team: product, platform, AWS infrastructure, security and AI. Names are generic; the systems are real. ### Autonomous ops agent AI. Works around the clock with the same skills engineers use: turns each new error into a ticket and a fix PR, reviews and fixes PRs until clean, updates packages daily, runs weekly security, cost and code scans, and consolidates team knowledge nightly. About 90% of its PRs get merged. It never merges itself. Stack: Hermes Agent, Claude, Sentry, EC2 ### Platform migration Platform. A legacy PHP/jQuery system rebuilt as React and Node services on AWS EKS without stopping the business. Now the same strangler pattern moves work off Salesforce: reads go through the Data API, CRM automations become event handlers, MongoDB becomes the system of record. Stack: React, Node.js, EKS, Salesforce, MongoDB ### Shared EKS cluster Infra & AWS. One Graviton cluster for 20+ services: spot node groups spread over six instance pools, cluster autoscaler, VPA and scheduled scaling, Kustomize overlays per app, version upgrades from written runbooks. Stack: EKS, eksctl, Kustomize, Graviton ### AWS Security Hub Security. AWS Config and Security Hub switched on, then a baseline of 122 failed findings across 45 controls worked one control at a time: fix and verify with a re-pull, or accept with a written reason. Stack: Security Hub, AWS Config, CSPM ### AI site editor for non-developers AI. A chat message becomes a file edit in an isolated per-user pod with a live preview. An accepted change leaves as a branch and a PR, only after the repo's own type-check and lint pass. Stack: Next.js, Kubernetes, Claude ### CI/CD in every repo Infra & AWS. Every repo ships the same way: ARM64 builds, staging on every push, production behind a release step with semantic versioning. Images deploy through Kustomize, SPAs sync to S3 behind CloudFront, packages publish behind a test gate. Stack: Bitbucket Pipelines, ECR, Kustomize, semantic-release ### Data API Platform. A VPC-internal service in front of MongoDB, DynamoDB and the CRM. Registry-driven with no domain logic; apps move reads over one resource at a time with an off → shadow → on switch. Stack: Fastify, MongoDB, DynamoDB, Salesforce ### WAF at the edge Security. Four web ACLs across load balancers and the CDN: managed rule sets, rate limits, geo rules, staging gates and a custom block page. Rules live in git and are applied by script. Stack: AWS WAF, CloudFront, ALB ### AI harness for the team AI. 70+ skills, layered rules and 230+ memory entries in one repo, loaded by Cursor and Claude Code. Deny hooks, post-work checks, and a nightly pass that turns repeated lessons into rules. Stack: Claude Code, Cursor, MCP ### Code reviews by agents AI. Every pull request gets an agent review: twelve isolated lanes, a skeptic that tries to disprove each finding, and a different lens on each round. Bot PRs are fixed and pushed until clean; human PRs get one honest comment. Stack: Claude, Bitbucket, CodeAnt ### Knowledge app for people and agents AI. A governed company wiki that replaces a SaaS tool: owners, review dates and a lifecycle per document, live co-editing, and semantic search. Agents read the same source of truth over REST and MCP. Stack: Next.js, Yjs, Atlas Vector Search, Bedrock, MCP ### AWS cost control Infra & AWS. 51 cost anomalies investigated and ranked, idle and legacy services retired, the rest right-sized. The monthly bill went down about 30% in two months without cutting capacity. Stack: Cost Explorer, Anomaly Detection, Graviton ### Access model Security. A permission library every app checks with: policy read once and cached per account, rolled out off → shadow → on. A coverage test fails the build when an ungated route appears. Stack: TypeScript, Valkey, Vitest ### Private deploy path Infra & AWS. Images are built in CI and deployed by CodeBuild inside the VPC, so the cluster API endpoint can go private. One Terraform module per service, least-privilege deploy RBAC. Stack: Terraform, CodeBuild, ECR, IAM ### Platform security review Security. A platform-wide review merged into one plan, image CVEs fixed against the digest that actually runs, and tiered egress network policies per workload, with private peering to the database. Stack: Inspector, ECR, NetworkPolicy ### SSO for every app Security. One sign-in for employees and customers across SPAs and Next.js apps: Google or one-time code, 60-second exchange codes, short-lived JWTs, fail-closed by default. Stack: Passport, Redis, JWT ### Backups & multi-region recovery Infra & AWS. An inventory of every AWS and SaaS dependency, a backup strategy per resource type, and a runbook to bring the platform up in a second region if the primary one goes dark. Stack: S3, MongoDB Atlas, Route 53 ### AI pentesting Security. Evaluated a self-hosted AI pentest agent in three measured runs: white-box repo scans now, active staging attacks once write suppression and allow-listed egress are in place. Stack: Strix, CodeAnt, OpenAPI ### MCP server for agents AI. Streamable HTTP MCP that lets agents look up properties and open maintenance requests, work orders and help-desk tickets through the core API with scoped keys. Stack: MCP, Node.js, TypeScript ### Shared packages & app scaffold Platform. Private npm registry, shared API, UI and lint packages, fleet update scripts, and a Next.js template that scaffolds a new EKS app with SSO, tRPC and data access in one command. Stack: Verdaccio, Next.js, tRPC ### File & media pipeline Platform. Resumable uploads, image transforms, document conversion and video transcoding behind one service, with queue workers and cron jobs for the heavy lifting. Stack: Sharp, FFmpeg, LibreOffice, SQS ### Communication hub Product. One timeline per contact: CRM tasks, calls, SMS, call transcripts and email, synced in the background and searchable in one place. Stack: Next.js, MongoDB, Salesforce, Gmail API ### Customer portal & public sites Product. Property search and listings, resident and owner portals, maintenance intake and billing, plus a services site with lead forms. Stack: Next.js, NextAuth, SES ### Health dashboard Product. Live business and tech metrics across the CRM, AWS, Kubernetes, Sentry and git in one screen. Read-only on every upstream, keeps its own history. Stack: Next.js, Kubernetes, AWS ### Accounting SaaS Product. Double-entry accounting with market-isolated ledgers per tenant, roles and API keys, and sync with the property systems. Stack: Blnk, Drizzle, PostgreSQL ### E-sign & scheduling Product. Document signing with high-memory PDF generation and post-sign hooks, and appointment scheduling with Google Calendar sync and reminders. Stack: PDF, Socket.io, SQS, Google Calendar ### Smart-locker kiosk Product. On-site package lockers: a React and Express app driving a C++ hardware SDK through a .NET 8 wrapper, running unattended under PM2. Stack: React, Express, .NET 8, C++ ## Tech stack Core: JavaScript, TypeScript, React, Next.js, Node.js, Express, GraphQL, AWS, Kubernetes, Docker, CI/CD, MongoDB, PostgreSQL, Redis, DynamoDB, Salesforce, Claude, Cursor. Tools: Fastify, tRPC, Mongoose, Drizzle, Redux, Vite, MUI, Socket.io, MCP, Hermes Agent, JWT, OpenAPI, Sentry, Bitbucket, Terraform, Biome, Vitest, Puppeteer, Sharp, FFmpeg, .NET. ## Contact Platform architecture, AI-assisted delivery, or a team that needs a hands-on lead. - [LinkedIn](https://www.linkedin.com/in/maksym-smovziuk) - [Upwork](https://www.upwork.com/freelancers/~0147401fc251c91a75) - [Email](mailto:symbianm@gmail.com) - [CV (PDF)](https://smovziuk.com/assets/maksym-smovziuk-cv.pdf)