Jean-Luc WilliamsSecure Systems Engineering & Cognitive Design
Software engineer with 6+ years across customer identity, cloud infrastructure, and enterprise backend systems — three of them on the Customer Identity team at a Fortune 500 hospitality company, where I lifted login success 27%, closed an IDOR by standardizing token validation, and restored core authentication services during an enterprise-wide security incident. Backed by an M.S. in Cyber Security (NSA CAE-CD) and a background in Cognitive Engineering, with a passion for all things electronic.
I Build Things to Find Out How They Work
I started college intending to study electrical engineering — I wanted to understand systems all the way down, to the trace on the board. I finished at RPI in Information Technology & Web Science with a concentration in Human-Computer Interaction and Cognitive Engineering, which turned out to be the same curiosity pointed one layer up: not just how a system works, but how it behaves for the person on the other side of it.
Professionally that landed me where authentication meets everything else — the guest login that has to succeed, the service token that has to be valid, the API gateway that has to hold. Unglamorous infrastructure people only notice when it breaks. Paired with an M.S. in Cyber Security from NYU, it means writing code with the failure modes already in mind, whether that is restoring services during a security incident or standardizing how a dozen services validate a token. These days I also review AI-generated code and media for model training — reading other people’s (and other models’) code with the same eye for what breaks.
The side projects are the same instinct off the clock: a costing SaaS for restaurants, a fighting-game engine with rollback netcode, soldered hardware, printed parts. I build them either to make something easier for the people who’d use it, or just because I love the thing itself and want others to enjoy it too. This site is where they collect.
Capabilities Matrix
Core StackIdentity & Access
OAuth 2.0, OpenID Connect, JWT/JWKS, Okta, Auth0, Apigee X, IAM, role- and scope-based authorization, token and session lifecycle design, Postgres row-level security, CPRA compliance.
Security
Secure code review, authentication and authorization flaws (IDOR, broken access control, token validation), incident response. Burp Suite, OWASP ZAP, Binary Ninja, Ghidra, Wireshark, Kali Linux, Pwntools, IPS rule writing, Akamai, Cloudflare.
Cloud & DevOps
AWS, Google Cloud (GCP), Microsoft Azure, Terraform, Docker, GitHub Actions, Azure DevOps, Git, Sentry.
Languages
Python, Node.js, TypeScript, JavaScript, Go, Dart, C#, C, C++, Bash, PowerShell, SQL. Working knowledge: Java.
Backend & Data
GraphQL, REST API design, PostgreSQL, MongoDB, Redis, Google Firestore, Supabase, Stripe.
Front-End
React, Next.js, Flutter, Tailwind CSS, HTML5, CSS3.
Featured Projects & R&D
Active Build LabFood Cost Guide — Restaurant Costing SaaS
Solo-designed and shipped a multi-tenant SaaS for restaurants, modeled as teams that own fully independent per-location datasets. A user-managed vendor Cost Guide prices recipes live — sell price, food cost %, labor cost, profit margin — against per-location, color-coded metric thresholds, with sales, purchasing analytics, and inventory tooling on every tier. Postgres row-level security is the real trust boundary: every location-scoped table resolves access through one shared predicate. Layered on top: Stripe subscription billing with per-location line items, soft tier-limit locking that never deletes a lapsed subscriber’s data, branded PDF exports with live-preview palette editors, country geo-blocking, GDPR cookie consent, self-serve data export and deletion, Sentry monitoring, and Redis-backed API rate limiting — all under a no-mock Supabase integration test suite. Ships as an installable, offline-capable PWA.
Rollback Fighting Engine
A from-scratch 2-D fighting game in Unity/C#, its two-lever controls taken from the 1984 arcade game Karate Champ and modernized — a real block button replacing the original's exploitable one, plus bluffable charge-and-commit attacks. A fully deterministic fixed-point simulation (no UnityEngine dependency, one blittable state struct) underpins hand-rolled rollback netcode that stays byte-identical through a 5,000-tick randomized-rollback sync test and a 95%-packet-loss simulation. Playable local 2-player versus today, plus a training mode with reactive dummy AI and a custom keyframe/hitbox animation tool.
Edibubble — Social Network
A foodie social network in Flutter (Riverpod, go_router) — discover restaurants and recipes, build and share curated lists, follow other users. Backed by a self-hostable Supabase stack with the full schema, row-level-security policies, functions, and triggers version-controlled as SQL, and an integration suite that exercises them against real Postgres instead of mocks. Includes a custom map view with collision-laid-out restaurant marker labels and bounded-batch geo queries.
Hardware Security & Maker Lab
Physical IoT and hardware security builds, including assembling and soldering a Slim Pwnagotchi for Wi-Fi network auditing, plus custom CAD models and 3D-printed structural components for multi-part assemblies.
Untitled Quadruped Physics Game
A QWOP-inspired physical-comedy game for dogs: players drive each leg independently through ragdoll/procedural physics in Unity, trading precise control for the same glorious, chaotic failure states that made the original a classic — reimagined for four legs instead of two.
Professional Experience
6+ YearsAI Training & Evaluation Contractor
Handshake AI · WorkadaJul 2026 – Present
- Evaluate, rank, and correct LLM-generated code for model training, judging correctness, edge-case handling, security, and adherence to prompt requirements; write reference fixes and rationales.
- Assess text-to-image, image-to-image, and video generation outputs for prompt fidelity, visual accuracy, temporal consistency, and policy compliance.
Founding Software Engineer
Fletcher Jones Management GroupApr 2025 – May 2026
- Founded the company's first internal software engineering team, transitioning ownership of a six-year enterprise platform away from external contractors and cutting new-engineer ramp-up from weeks to days through authored runbooks and deployment documentation.
- Architected CI/CD pipelines in GitHub Actions, automating deployments across environments and giving the executive suite real-time visibility into release status.
- Partnered with the CTO on a multi-year roadmap to consolidate the company's technology stack.
- Instituted technical auditing of external vendor deliverables and standardized deployment practices across 10 locations, reducing configuration drift.
- Optimized core platform logic to recover 5%+ of platform usage limits, extending the runway of the existing architecture without a costly re-platform.
Software Engineer, Customer Identity Team
MGM Resorts InternationalJan 2022 – Apr 2025
- Built the guest guided sign-in experience and redesigned surrounding identity flows, driving a 27% increase in login success and a 25.7% increase in account activation while eliminating the top recurring guest-reported errors.
- Authored a centralized JWT validation helper adopted across the team's Node.js services, configurable per endpoint by allowed token type (service, guest, anonymous) and required roles or scopes; enforced complete best-practice claim validation — Okta JWKS signature, issuer, audience, and validity windows — closing an IDOR vulnerability found while triaging an on-call alert.
- Modernized identity systems to strict OAuth 2.0 compliance and supported migration from scope-based to service-role-based JWTs across a polyglot stack (Java, Node.js, Python, Dart); consolidated TypeScript services onto Node.js to narrow the maintenance surface.
- Authored the modernization architecture for the legacy mobile authentication stack against mobile-team requirements, surfacing an ownership risk that redirected the effort toward a vendor-supported Okta path.
- Supported multiple teams through recovery from an enterprise-wide security incident: rebuilt the team's AWS environment to restore an undocumented legacy mobile authentication service — its only workload there — that was blocking the recovery timeline, and assisted bring-up of the team's remaining services.
- Manually rotated the Okta client IDs and secrets used by most backend services to mint service tokens, coordinating secure redistribution to dependent teams; reverse-engineered a partner team's Java service to resolve a credential-hashing mismatch blocking reintegration.
- Guided partner teams through Apigee X gateway adoption after it became mandatory post-incident, and diagnosed VPN-related network failures with workarounds that kept development unblocked.
- Worked with the security team during a bot traffic campaign, analyzing request patterns in Akamai to help tighten firewall rules without blocking legitimate guest traffic.
- With no new projects starting on the combined Identity and Profile team, embedded on teammates' in-flight projects to ship them faster — taking on GraphQL changes, production debugging, and unblocking partner teams' integrations with our services.
- Established the team's first Dart backend pattern on GCP/Firestore for personalized preferences and targeted offers, which ran without a single production incident from launch through departure; modernized Azure DevOps and GitHub Actions pipelines with parameterized variables, reusable workflows, and atomic components.
- Automated account data reconciliation and CPRA compliance request processing; mentored engineers from non-CS backgrounds on diagnostic technique, testing, and secure development.
Webmaster
Largo Consulting Services, LLCApr 2020 – Jan 2022
- Owned the full lifecycle — design, security, and optimization — of 11 client websites on WordPress and BigCommerce.
- Hardened client sites with threat monitoring and custom IPS rules, resolving bugs and vulnerabilities within an hour of detection.