AI/ML engineer and technical architect in Connecticut
I've been building software for more than 20 years, most of it for insurance and healthcare companies here in Connecticut. These days I build AI agents that do real work in production, plus the less glamorous parts that make them trustworthy: the data, the memory, the permissions and the tests.
Most recently I was a Senior Staff Software Engineer on the reliability team at The Hartford (July 2025 – July 2026), where I designed and shipped two internal AI platforms. Before that I spent 18 years at CVS Health / Aetna, much of it on the company-wide Spring framework.
At home I build things for my family: a photo backup that runs on a Mac mini and their iPhones, an AI agent that runs the lights and speakers, and a research platform for the U.S. power markets. They're all below.
I'm looking for a Staff or Principal role in AI engineering or AI architecture. Email is the quickest way to reach me: duong.nick@gmail.com.
Selected projects from The Hartford and CVS Health / Aetna. The first three have architecture notes with diagrams.
An incident-response assistant that engineers reach from Microsoft Teams, the CLI or a web chat. It pulls Splunk logs and Dynatrace problems, checks recent GitHub deploys and answers with evidence. When a service breaks again, it remembers how the last incident was fixed.
It runs on Google ADK and Gemini, with model failover behind a circuit breaker. Its 80+ tools sit behind a fail-closed allowlist, and the test suite is past 2,200. Architecture notes: ReliBot
An AI security reviewer. A root agent hands work to specialist agents for planning, code security, dependencies, reporting and remediation. Deterministic validators check every finding before a person sees it, and a finding only closes once the fix is proven. Fixes go out as patches for review. Nothing is pushed automatically.
Delivery is keyless: AWS CodePipeline deploys to Cloud Run through Workload Identity Federation. 3,400+ tests at 86% coverage, threat-modeled against the OWASP Top 10 for LLM apps. Architecture notes: GitHubScanner
Two retrieval systems over the same corpus. Gemini extracts a schema-constrained knowledge graph into Neo4j, and questions are answered with parameterized Cypher templates picked by intent, so there is no free-form text-to-Cypher. A LangGraph and ChromaDB twin serves as the vector baseline.
An A/B harness kept Gemini 2.0 Flash in production over the 2.5 Pro preview (100% success at a 12.2 s median, against 32% at 47.2 s). Replacing always-on VMs with scale-to-zero Cloud Run cut hosting cost by about 98%. Architecture notes: GraphRAG
I led the move of legacy Spring applications to Spring Boot using OpenRewrite and Claude Code, wrote refactoring recipes that other departments picked up, and ran the architecture reviews. I also owned the Aetna Enterprise Framework, the company-wide Spring framework, with its reference apps, the OpenShift platform, REST and SOAP APIs, OAuth2 and SSO, and API management on CA Layer7 and IBM API Connect.
These run every day on my own hardware, each with its own decision log and test suite. The repos are private, but I'm glad to walk through any of them. Longer write-ups
My personal agent platform. One manager process runs 12 bot instances on Telegram, each with its own markdown-vault memory, and it handles my smart home and messaging every day. A per-message router picks Haiku, Sonnet or Opus. Memory search blends vector and BM25 scores with time decay and MMR re-ranking.
Tool calls go through a fail-closed policy with prompt-injection fencing, and voice notes are transcribed locally, so no audio leaves the house. 220+ MCP tools, 3,500+ tests.
Every night, Claude rewrites a stock-ranking pipeline, and a walk-forward backtester the model can't see decides whether the change stays. A bear-case critic and a set of validators throw out bad candidates, including SQL look-ahead, before anything is backtested. About one rewrite in ten has survived so far.
Warren is the Telegram bot that sits on top. It reviews stocks through four investor lenses and cites its evidence. It has said BUY about 1% of the time, and it places no orders.
A Google Photos replacement for my family: a Swift/Vapor server on a Mac mini, a React web app and a native iPhone app, all built against one versioned API contract. Face detection and clustering run on the Mac mini and have found about 24,700 faces in 26,000 photos.
The iPhone app (Swift 6, SwiftUI) backs up the whole library in the background and picks up where it left off after an interruption. Cutting it back to backup-only deleted 14,330 lines and got it shipped. My family uses it through TestFlight.
A DuckDB warehouse for U.S. wholesale power markets, with bronze, silver and gold layers and PyTorch forecasters on top. It holds about 1.27 billion rows, including 90M+ hourly MISO nodal prices. Rewriting the collectors with async HTTP/2 cut the daily pull from 20–60 minutes to 38 seconds.
The part I'm proudest of is the audit harness. It caught a look-ahead leak in my own research and turned 5 of 8 headline backtests negative, so I retired my best-looking number.
I'm a neurodivergent engineer, and I think in knowledge graphs. I map the whole system before I write code, then build all of it and stay with it after it works. On the energy platform I rewrote the data collectors after they already worked, which is where the 38-second daily pull came from.
I write decisions down. Every project keeps a decision log, a bug log and a handoff doc, so the context lives in the repo; ClawBot has 98 dated decision records. I like to settle the interface before the code. DVPhoto's server, web app and iPhone app share one API contract, which is on its 29th release.
Edge cases and root causes get a lot of my attention. In the energy platform, missing data is logged as unknown and never quietly set to zero. Once, an iPhone crash loop looked like a code bug. It turned out to be a provisioning profile that had dropped an entitlement, and the crash had also silenced the telemetry, so the empty error log proved nothing.
I do my best work with a clear problem statement, written specs and long stretches of focus. I batch meetings and answer in writing. Give me the real goal and the constraints, and I'll come back with a design, its trade-offs and a plan to ship it.
Built ReliBot and GitHubScanner on Google ADK and Gemini and deployed them to AWS and GCP Cloud Run with Terraform. Mentored engineers on agent design and testing.
Owned the company-wide Spring framework and its OpenShift platform, led the Spring Boot modernization and built the GraphRAG pilot.
Fleet engine diagnostics and forecasting applications in Java, Spring, Hibernate and Oracle.
Enterprise integration middleware and portal applications.
Email reaches me fastest: duong.nick@gmail.com. I'm also on LinkedIn. Or leave a note here.
Sent through Formspree.