Mangesh Bide
Backend / Platform Engineer
Summary
Backend / Platform Engineer with 2+ years of production Python and Django experience (since Feb 2024) on healthcare systems in Python, TypeScript, PostgreSQL, and AWS. Led a greenfield authentication and authorization platform from architecture to production deployment. It runs on self-hosted Keycloak, custom Java SPIs, OIDC, multi-tenant SSO with IdP federation, and SpiceDB-based ReBAC. Own the backend architecture and infrastructure end to end on a HIPAA-aligned, multi-tenant healthcare SaaS. Additional production experience: real-time voice pipelines and agentic AI systems.
Experience
Software Development Engineer I (promoted from intern, Apr 2025)
Feb 2025 – Present
House Works Technology, Remote
- • Led a greenfield authentication and authorization platform for a multi-tenant healthcare SaaS. Owned the architecture, authorization modeling, service integration, rollout, and production deployment.
- • Built and operated self-hosted Keycloak in production for healthcare identity management: deployment, configuration, upgrades, backups, OIDC integration, session management, and account lifecycle controls. Developed custom Java SPIs, providers, and extensions for business-specific identity requirements.
- • Designed fine-grained authorization with SpiceDB (Google Zanzibar model) for the Django and DRF APIs. Its ReBAC model has 16 object types and 45 permissions across organizations, programs, patients, cases, review boards, and clinical documents.
- • Implemented multi-tenancy with Keycloak Organizations and tenant-aware authentication flows. Built IdP Federation with domain-based SSO, which routes each user to their enterprise identity provider by email domain.
- • Kept the SpiceDB authorization graph consistent with PostgreSQL through a transactional outbox and an async worker. Reconciliation and consistency checks detect and repair authorization drift.
- • Wrote the architecture decision records and the phased ReBAC execution plan for the platform before the build. Authored about half of the merged pull requests in its API and identity service repositories.
- • Hardened identity with mandatory TOTP MFA, instant session revocation (OIDC back-channel logout, Redis denylist), and user lifecycle flows (invites, suspension, termination, rehire, credential reset). Built per-tenant password policies and an audit-event producer as custom Keycloak SPIs, and recorded lifecycle events in an append-only audit ledger.
- • Added supply-chain security gates to CI: a CycloneDX SBOM, dependency audits, a release-age cooldown for new package versions, and digest-pinned base images. Configured AWS ECS deploys that run database migrations as one-off tasks before services roll and reconcile Keycloak client secrets from AWS Secrets Manager.
- • Architected a real-time multilingual voice transcription and translation pipeline for a production EHR that serves 1,000+ patients. Clinical conversations in English, Spanish, and Mandarin stream through Azure Speech (Azure Cognitive Services) into structured clinical notes in PostgreSQL.
- • Built patient management and appointment scheduling APIs, an ICD-10 coding engine, and AWS Cognito-based authentication. Worked across clinical documentation, ICD-10-CM diagnosis coding, modifier codes, healthcare coding logic, and NCCN-based clinical decision support.
- • Shipped clinical document generation: a PDF template manager for clinical notes and facesheets, DOCX-to-PDF conversion, and bulk document export (merged files, separator sheets, ZIP). A PDF microservice runs the export, and Celery jobs report progress and support cancellation and stale-job cleanup.
- • Built case-review dashboard APIs with turnaround-time metrics and organization-level filtering, backed by database index optimizations. Added a scheduled job that reconciles application users against AWS Cognito and emails a CSV report.
- • Provisioned per-tenant Medplum (FHIR server) projects and clients from Django admin. Moved the product's AI-assist feature to AWS Bedrock, which removed a direct third-party model API key.
- • Own the backend stack (Django, DRF, PostgreSQL, AWS), which handles 10K-100K requests/day.
- • Built production infrastructure with Terraform (workspaces for staging and production), Docker, AWS EC2, and GitHub Actions CI/CD with automated EC2 deployments. Cut deployment time from ~45 min to ~12 min (~70%).
- • Built healthcare audit and observability infrastructure with ClickHouse, Sentry, and Grafana. Integrated Sentry performance monitoring into the EHR API and fixed the N+1 queries that it surfaced.
- • Maintained tenant isolation across API authorization and database access.
- • Took part in the weekly on-call rotation and responded to production alerts from Sentry, All Quiet, and AWS.
- • Migrated legacy Django views to DRF ViewSets (~40% less boilerplate) and added hot reloading to the Django backend.
- • Write Pytest unit and integration tests and review code (230+ pull requests for 13 engineers since Jul 2025). Ship React.js and Next.js features end to end.
Software Development Engineer Trainee
Oct 2024 – Feb 2025
Procedure Technologies, Mumbai, Maharashtra
- • Built full-stack production features with React.js, Next.js, TypeScript, and NestJS. Containerized services with Docker and provisioned cloud infrastructure with Terraform.
Backend Developer Intern
Feb 2024 – Jul 2024
Netwin Infosolutions Pvt Ltd, Nashik, Maharashtra
- • Designed REST APIs with Django and MySQL, JWT authentication, and RBAC for a Flutter activity-tracking application. Integrated ML-powered image search and OTP and email verification.
Education
B.Tech in Computer Engineering
R. C. Patel Institute of Technology, Shirpur
2021 – 2024
CGPA: 7.98/10
Diploma in Computer Engineering
R. C. Patel Polytechnic, Shirpur
2019 – 2021
93.89%
Certifications
- • AWS Certified AI Practitioner (AIF-C01), Amazon Web Services, 2026
Technical Skills
Languages
- • Python
- • TypeScript
- • JavaScript (ES6+)
- • Java
- • SQL
Identity & Authorization
- • Keycloak (Organizations, custom SPIs, providers, extensions)
- • SpiceDB
- • ReBAC
- • OAuth 2.0
- • OIDC
- • JWT
- • SSO
- • IdP Federation
- • TOTP MFA
- • OIDC Back-Channel Logout
- • Multi-Tenant Architecture
- • AWS Cognito
Backend
- • Django
- • Django REST Framework
- • Celery
- • FastAPI
- • NestJS
- • Node.js (Express)
Databases
- • PostgreSQL
- • MySQL
- • MongoDB
- • DynamoDB
- • Redis
- • pgvector
Cloud & Infrastructure
- • AWS (ECS, EC2, S3, Lambda, API Gateway, IAM, Cognito, CloudWatch, Secrets Manager, Bedrock)
- • Oracle Cloud
- • Terraform
- • Docker
- • GitHub Actions
- • CI/CD
- • Shell Scripting
Distributed Systems
- • Transactional Outbox
- • Async Workers
- • Idempotency
- • Reconciliation
- • Event-Driven Systems
Healthcare
- • HIPAA-aligned Systems
- • EHR Workflows
- • ICD-10-CM
- • Modifier Codes
- • Clinical Coding Workflows
- • NCCN Guidelines
- • FHIR (working knowledge)
- • Medplum
- • HL7 (working knowledge)
Observability
- • Sentry
- • Grafana
- • ClickHouse
- • Structured Logging
AI / Voice
- • Gemini
- • OpenAI
- • LLM Orchestration
- • Prompt Engineering
- • RAG
- • Embeddings
- • Agentic AI
- • Tavus CVI
- • Daily/WebRTC
- • Azure Speech (Cognitive Services)
- • Multilingual ASR/TTS
- • Cloudflare Workers AI (Llama 3.2)
- • Claude Skills
Frontend
- • React.js
- • Next.js
- • Tailwind CSS
- • shadcn/ui
- • Astro
Practices
- • REST API Design
- • Pytest
- • Unit/Integration Testing
- • Code Review
- • Architecture Decision Records
- • Supply-Chain Security (SBOM, Dependabot)
- • Agile/Scrum
Spoken languages
- • Hindi (native)
- • Marathi (native)
- • English (full professional)
Key Projects
Mira: Voice Front-Desk Agent
Built a real-time conversational AI agent with Daily/WebRTC voice, an avatar, and 7 booking tools. It has slot-conflict and idempotency guards, 10 unit tests, and Gemini-generated call summaries.
Fieldnotes: Agentic Job Research System
Agentic RAG system: a multi-stage planner-executor-synthesizer agent with tool use and embedding-based retrieval. It researches companies, inspects GitHub engineering footprints, and compares resume embeddings against job requirements. It returns structured apply, consider, or skip verdicts with cost and latency observability.
HIPAA Guardian
Built a PHI and PII detection engine that scans source code, data files, logs, and API responses for all 18 HIPAA Safe Harbor identifiers.
Added confidence scoring, HIPAA rule mapping, and audit reports, and excluded known-safe patterns (never-issued SSN ranges, 555-01xx numbers, example.com) to keep false positives low.
Claude Skills collection
Published a collection of reusable Claude Skills with 300+ downloads.