Skip to content
sudip.sys
Email

guest@sudip-subedi.com.np:~$ whoami

Sudip Subedi

Software Engineer — Backend, Databases & System Design

I build backend services▍

Open to backend & full-stack roles

I'm a software engineer with about two years in production — backend services, SQL databases, API integrations and the occasional security fire. Most of that has been in fintech, but the habits travel: correct data, clear failure modes, and code the next person can read.

  • End to end

    Owned a production platform's full dev cycle

  • FCA

    Compliance monitoring shipped

  • 1 paper

    Explainable-AI research, submitted

  • 3 awards

    AI competition + 2 hackathons

Email me Resume GitHub LinkedIn

request-lab / try it

idle
  1. client
  2. guard
  3. api
  4. sql
  5. kafka
  6. 3rd-party

Pick a scenario to send a request through the stack.

0
served
0
blocked
0
deduped
0
recovered

simulation · drag log corner to resize

$ ls ./work

Case studies

01 · Production · fintech

Multi-channel transaction platform

End-to-end owner

01Problem

One core, one customer record and one audit trail behind five channels — web, mobile, admin, agent and partner API — each partner with its own rules and providers.

02Trade-offs

  • Money-critical state changes live in stored procedures, inside one transaction boundary.
  • Partner adapters validate mapped payloads before anything reaches the partner.
  • Audit logs go async, so they never slow the request path.

03Impact

  • Own the full development cycle — backend, database, UI and release support.
  • Built regulatory monitoring (UK FCA Consumer Duty): real-time tracking and vulnerability detection.
  • Delivered third-party identity and payment integrations, plus a MongoDB audit logger.
stackNode.jsSQL ServerMongoDBRedisKafkaReactREST / SOAP
 channels                    domain services               data & partners
┌──────────────┐            ┌────────────────────┐        ┌────────────────────────┐
│ admin portal │            │ transactions       │        │ SQL Server             │
│ customer web │            │ compliance / AML   │        │   stored procedures    │
│ mobile app   │  ──API──►  │ configuration      │  ───►  │   ledger + audit trail │
│ agent portal │            │ customers / KYC    │        ├────────────────────────┤
│ partner API  │            │ reporting          │        │ cache · object store   │
└──────────────┘            └────────────────────┘  ───►  ├────────────────────────┤
                                                          │ third-party providers  │
                                                          │   REST · SOAP          │
                                                          └────────────────────────┘
                              └─ async audit logs ──► Kafka

02 · Production · security

VAPT resolution: hardening a live platform

1 fix · 3 platforms

01Problem

After a live security incident, a VAPT assessment flagged SQL injection, role-based access control (RBAC) gaps and other issues on a production platform. Everything had to be fixed while the system stayed online.

02Trade-offs

  • Contain first: a request-layer injection guard went live immediately, while queries were moved to parameters behind it.
  • Access control enforced on the server with role-based checks per route (deny by default), not by hiding buttons in the UI.
  • Every blocked or denied request is logged with context, so the defences double as a detection signal.

03Impact

  • Wrote the injection fix with the response team; the same code now protects three production platforms.
  • Closed the VAPT findings — from RBAC gaps to input validation — and re-tested each fix.
  • Carried the lessons into a security-first design for a new customer portal.
stackNode.jsExpress middlewareRBACJWTSQL ServerVAPT
  request ──► ┌──────────────────────── defence in depth ─────────────────────────┐
              │ 1. injection guard   route schema (allow-list) + pattern checks   │
              │ 2. authenticate      verify JWT, reject expired / tampered tokens │
              │ 3. authorize (RBAC)  role × route permission — deny by default    │
              │ 4. handle            parameterised query / stored procedure only  │
              └───────────────┬──────────────────────────────────┬───────────────┘
                              ▼                                  ▼
                   200 / generic 4xx code              security log (ip, route, rule)
                   (no internals leaked)               → reviewed, feeds re-testing

03 · Research · IC-AICSE submission

RARE-AI — explainable, risk-aware decision routing

−$0.0341 / txn

01Problem

Fiat or stablecoin? The cheaper, faster rail changes with amount, liquidity, calendars and destination law — and no record shows what the rail you didn't pick would have done.

02Trade-offs

  • Legality and availability are hard gates, never traded off against price.
  • Route on expected cost in dollars: quoted price + λ × P(missing the deadline).
  • ML predicts only deadline-miss risk; evaluated on matched counterfactuals with bootstrap intervals.

03Impact

  • Fee structure, not settlement technology, decides which rail wins.
  • Showed when ML routing is worth switching on — and when to switch it off.
  • Fully reproducible package: number traceability and independent AI auditors.
stackPythonGradient boostingBootstrap statsPandas
   transfer request (amount, corridor, deadline D)
                │
   ┌────────────▼─────────────┐   non-compensatory gates
   │  legality  ·  availability│── rail illegal/closed? ──► excluded
   └────────────┬─────────────┘
        ┌───────┴────────┐
        ▼                ▼
   rail T (fiat)    rail S (stablecoin lifecycle)
   C_T = quoted     C_S = quoted + network + on/off-ramp
   p_T = P(τ_T>D)   p_S = P(τ_S>D)        ◄── ML predicts ONLY these
        └───────┬────────┘
                ▼
     J_r = C_r + λ · p_r      choose argmin J   (+ explanation)
                │
   H: provider-internal hybrid settlement ─► separate treasury decision

$ grep -r lessons ./debugging

Problems I've worked through

  • Security

    Injection attempts against legacy endpoints

    Contained it with a request-layer guard (allow-list + pattern checks), then moved queries to parameters.

    Contain first, fix properly second.

  • Databases

    No defined recovery point for a live database

    Planned automated FULL + differential backups, with log backups as the next step for point-in-time restore.

    A backup only counts once a restore has been tested.

  • Infrastructure

    Intermittent API failures with clean application logs

    Traced traffic reaching the wrong workloads and tightened service selectors with the infra team.

    When the code looks fine, check the path.

  • Data handling

    Date parsing that broke depending on server locale

    Replaced implicit conversion with explicit TRY_CONVERT(date, @v, 105) plus input validation.

    Never let the server guess a format.

  • Integrations

    Outbound requests failing before they were even sent

    Followed the payload through the mapping layer; added validation before any external call.

    Validate at the boundary you own.

  • API contracts

    A list returned as an object with numeric keys

    Found an array being object-spread into the response; made the response shape explicit.

    Contracts deserve types, not assumptions.

$ select * from skills;

Skills, as a schema

TABLE backend_apis

Services, integrations and the contracts between them.

backend_apis
runtimeNODENode.js · Express · Flask
styleAPIREST · SOAP · microservices
authJWTToken auth, role checks, input validation
partners3RD-PARTYIdentity, payment & messaging providers

TABLE databases

Where correctness lives. Fast is second.

databases
enginesSQLSQL Server · PostgreSQL · MongoDB
logicPROCStored procedures, transactions, constraints
tuningINDEXQuery plans, deadlocks, type conversion
recoveryBACKUPFULL / DIFF / LOG chains, RPO planning

TABLE async_and_distributed

Keeping slow work off the request path.

async_and_distributed
streamKAFKAAsync audit / API logging pipelines
cacheREDISCaching, lookups, short-lived state
safetyIDEMPIdempotency keys, safe retries, timeouts
jobsCRONBackground and reconciliation jobs

TABLE frontend

Enough to ship the whole feature, not just the API.

frontend
uiREACTReact · TypeScript
stateSTORERedux Toolkit slices & async flows
designKITAnt Design · Tailwind CSS
debugTRACEUI state → payload → service → DB

TABLE ai_and_data

Applied where it measurably helps.

ai_and_data
agentsLLMLLM web agents, scraping pipelines
retrievalEMBEDEmbeddings, semantic search, PDF QA
modelsMLTensorFlow · gradient boosting · LSTM
visionCVOpenCV · Stable Diffusion · Raspberry Pi

TABLE security_and_ops

Hardening day to day; infra as working knowledge.

security_and_ops
appsecVAPTVAPT fixes, SQL-injection guard
auditLOGStructured audit logging (MongoDB)
runtimeBASICDocker · Kubernetes basics · Linux
cloudCERTAWS Cloud Practitioner

$ git log --oneline

Experience

branch: work

  1. e05a7c3 · Dec 2025 – present(HEAD)

    Associate Software Engineer · City Express Money Transfer

  2. 9d41f6b · Apr 2025 – Dec 2025

    Software Engineer Intern → Trainee · CityTech, Kathmandu

  3. 7c2e18a · Jan 2025 – Mar 2025

    Data Science Fellow · Fellowship.ai — San Francisco (remote)

branch: education

  1. 3be94d0 · Feb 2021 – Aug 2025

    B.E. Computer Engineering · Kathmandu University, Dhulikhel

  2. a1f0c21 · 2019 – 2021

    +2 Science · SOS Hermann Gmeiner School, Bharatpur

Awards

  • 2024IT Meet AI Competition — Winner
  • 2024KU HackFest — Best UI Design
  • 2023KU HackFest — Best Use of Redis

Certifications

  • AWS Cloud Practitioner (CLF-C02)
  • Associate Data Analyst
  • DevOps Pre-Requisites
  • Linux Basics
  • PCAP Python
  • AI Associate
  • Python OpenCV
  • Agile & Project Management

Leadership

  • President, Geetanagar Junior Jaycees (2022)
  • College Ambassador, Idea Studio Nepal (KU)
  • Event Manager, IT Meet Mock Placement
  • Organizing Committee, Hult Prize at KU (2022)
currently improving
  • Test-first habits
  • Sharper estimation
  • Kubernetes & GitOps fundamentals
  • Observability with OpenTelemetry; system design at scale

$ ls ./projects

Built outside work

  • ML · markets

    NEPSE Stock Forecaster

    LSTM forecasting on scraped NEPSE price history.

    TensorFlow · Keras · Pandas

  • NLP · retrieval

    PDF Answer Retriever

    OCR + semantic search that answers questions from PDFs.

    Python · OCR · Embeddings

  • Full-stack

    AttHire

    Rental marketplace with auth, inventory and an admin panel.

    React · Node.js · MongoDB

  • Computer vision

    Virtual Trial Room

    Pose detection + Stable Diffusion for virtual try-on.

    Stable Diffusion · OpenCV

  • AI · hardware

    Face-tracking System

    Real-time multi-user face tracking on a Raspberry Pi. IT Meet AI winner.

    OpenCV · Raspberry Pi · Python

  • Mobile · Redis

    SmartKagaj

    Paperless contract signing and authentication. Best Use of Redis.

    Mobile · Redis · Auth

  • Fintech · UX

    SapatiSewa

    Digital micro-loan service concept. Best UI Design.

    UI/UX · Product design

  • live demo

    Coming soon

    An interactive demo you'll be able to run right here.

  • Next.js · static

    This site

    Static-export portfolio with an in-browser request simulator and shell.

    Next.js · TypeScript · Tailwind

$ cat reviews.md

In their words

At a young age, Sudip has effectively been handling the entire development cycle of [our remittance platform]. He stepped in during a live security incident and helped write the fix — a single piece of his work is now protecting three platforms.

Rahul Krishna Kharel

Project Manager

Annual performance review · 2026

One of the most enthusiastic and dedicated team members I've come across. His research skills are outstanding — he dives deep into problems, explores multiple perspectives, and comes up with practical, well-thought-out solutions.

Ashish Gautam, PhD

Lead Software Engineer · managed Sudip directly

LinkedIn recommendation · Aug 2025

$ whoami --off-call

Away from the keyboard

  • Cricket

  • Stocks & investing

  • History

  • Business & innovation

$ ./shell

Prefer a CLI?

Everything on this page is also reachable from a shell. It runs entirely in your browser.

guest — sudip-subedi.com.np
{$} sudip.sys interactive shell · v1.0
Welcome. Type 'help' to list commands — try 'cat resume', 'stack', 'problems' or 'sudo hire-me'.

$ mail --to sudip

Let's build something reliable.

Open to backend and full-stack roles — fintech or not. I usually reply within a day.

Email meResumeLinkedIn