Summary
AI engineer and software developer who builds LLM applications end to end and measures them before they ship, from tool-calling agents over retrieval-augmented generation (RAG) to QLoRA fine-tunes on local hardware. Runs Hummus Development, shipping Next.js and React Native products and Python and Node backends on PostgreSQL for paying customers. Earlier roles brought Python test automation and NIST-aligned security work in federal environments, plus firmware builds and Red Hat Linux node work on safety-critical communication systems. CompTIA Security+ and Microsoft Azure Developer Associate (AZ-204) certified.
Experience
Founder & AI/ML Software Engineer — Hummus Development LLC, McLean, VA
- Built the LLM projects detailed under Projects, including Hummus IQ, a local-first agentic assistant with its own six-model evaluation harness; a QLoRA fine-tune of a 7B code model; and a conversational lead qualifier for All Service Leads.
- Wrote 3,000+ automated assertions across 40+ suites behind Hummus IQ's single release gate, ran red-team rounds before shipping, and used a model A/B benchmark to reverse a change that only looked like an improvement.
- Shipped four apps to the App Store and delivered client sites and platforms in 2026 (a lead marketplace with live Stripe billing, e-commerce storefronts, a multi-brand rebuild). Run the hosting stack directly (Vercel, Netlify, Supabase, Twilio, Resend) with rollback drills and incident playbooks.
Field Engineer – Software, Firmware & Deployment — Frequentis
- Built and factory-updated device firmware for safety-critical communication systems.
- Worked over SSH and PuTTY on the Red Hat Enterprise Linux (RHEL) nodes behind these systems, including RabbitMQ messaging between services.
- Handled on-site installation and deployment: site surveys, wiring diagrams, structured cabling, terminations, and grounding.
Field Engineer II – Systems & Integration — NextgenID, McLean, VA
Promoted Aug 2025 from Quality Assurance & Cybersecurity Engineer (Aug 2024 – Aug 2025)
- Worked on site in federal customer environments, supporting integration, configuration, and releases of identity-management software on compliance-controlled networks.
- Configured systems in line with NIST and FIPS controls, deployed the hardware and software at multiple client sites, and worked with customer staff and internal engineering to trace recurring faults to a fix.
- As QA & Cybersecurity Engineer, built Python unit and integration test automation that cut manual QA effort by more than 40%; also deployed SIEM, configured network security controls, ran vulnerability assessments, and wrote FedRAMP and NIST 800-53 audit documentation.
Lead Technical Specialist — New Horizon Hosting LLC
- Developed PHP/SQL web applications and operated the Windows Server environments hosting them.
Selected Projects
AI Engineering
Hummus IQ
Local-first agentic LLM assistant
- Designed the request router: a triage step sends each request to a direct answer, a 10-round tool-calling agent over ChromaDB retrieval with inline citations, a plan-solve-verify-revise loop, or a best-of-N ensemble with an LLM judge and a synthesis step.
- Built the evals for its coding agent: six open-weight models on 12 tasks, scored by 218 hidden unit tests in a network-denied sandbox over two full passes, against a do-nothing baseline.
- Reading the run transcripts turned up an agent-loop bug: the agent had overwritten files with placeholders 207 times in 144 runs. Two fixes to the loop raised every model's hidden-test pass rate across both passes; qwen3:14b went from 38% to 70%.
- A/B-tested a 1.7B model for triage and verification. It looked 5–16× faster but misrouted all four reasoning test questions and caught none of three planted wrong answers (the 14B caught all three), so the change was reverted.
- Hardened it for NDA and government-sensitive work: a prompt-injection trust boundary keeps retrieved pages, tool results, and memory out of the system prompt as untrusted data, and the air-gap mode fails closed. Red-teamed the sandboxed Python tool over three rounds and pinned every escape with a regression test; completed a NIST SP 800-171 self-assessment of all 110 requirements, with a POA&M for open items.
PythonFastAPIChromaDBOllama
AI Lead Qualifier
Built for All Service Leads
- Built the extraction step that pulls lead details into a JSON schema with one repair retry, then added a grounding check after small local models started inventing facts the customer never stated.
- A 12-point rubric decides when to page the sales team, and every outbound message passes one fail-closed guardrail for opt-outs and TCPA-style messaging rules. Verified end to end on web chat.
TypeScriptLocal qwen3:14bWeb chatMessengerSMS
QLoRA Fine-Tuning
7B code model on a single 16 GB GPU
- Fine-tuned qwen2.5-coder 7B on one RTX 4060 Ti with 4-bit NF4 and LoRA r=16 on all attention and MLP projections (0.53% of weights), using assistant-only loss masking at about 12.6 GB VRAM.
- When Triton would not compile headless, rewrote the trainer directly on Transformers, PEFT, and bitsandbytes. Generated the 2,400 training conversations in plain Python, then exported the adapter to GGUF and served it through Ollama on the stock quantized base.
- Turned it into an on-prem feature that fine-tunes a coding model on a team's own repository, with secrets filtered out and the encrypted dataset kept on the machine. On the codebase of a production app (1,139 training and 53 held-out examples) it reached a held-out loss of 0.64; a hand-run comparison with the base model showed better formatting and house style but weaker schema recall.
PyTorchTransformersPEFTbitsandbytes
Papi AI
App Store
Consumer LLM app (iOS)
- Built the FastAPI backend: SSE streaming, vision, whisper-large-v3 voice transcription, and per-conversation memory. When the hosted provider retired the vision and text models the app depended on, rebuilt both paths as fallback chains that skip retired models and fail over on rate limits.
FastAPIGroqSSE
On-Prem GPU Inference Server
OpenAI-compatible gateway
- Run a home GPU server behind a custom OpenAI-compatible API (streaming chat completions, embeddings, text-to-speech) with bearer auth and model-name mapping. It runs as an auto-restarting service, and cloud-hosted apps reach it over a private Tailscale network.
OllamaFastAPITailscale
Software
Car Lounge
App Store
Car-community social app
- Solo build, 200+ commits. The backend has 123 Postgres migrations defining 120+ row-level security policies and 130+ SQL functions, plus 12 Edge Functions for App Store receipt validation, Stripe webhooks, and moderation. CI runs type-check, lint, 800+ Jest tests, and a Playwright smoke test, then builds and submits the iOS app from a macOS runner.
React Native / ExpoSupabase
E-Commerce Platform
Retail client
- Seven-week solo build on a 20-table Postgres schema, handling affiliate commissions with CSV payouts, PayPal and merchant-of-record webhooks, and state sales tax; a cron expires unpaid orders, and an admin console runs shipping and refunds. Later forked for a second brand.
Next.js 16TypeScriptPostgreSQL
Lead marketplace & multi-brand rebuild
- All Service Leads: designed the platform and, with two collaborators, took it to production in April 2026 (Express/Node on Netlify Functions, Supabase Postgres, Stripe checkout, Twilio SMS, Resend email). Still building it as it grows into prepaid leads and live call transfers.
- Wheaton Valet Cleaners: built a single Next.js 16 codebase (26 routes) serving a dry-cleaning group's flagship, sister brands, and locations. An intake endpoint sends Resend email and OpenPhone SMS, and a knowledge-base chatbot falls back to a hosted LLM. Kept on for monthly SEO.
- Buckets is a Three.js/WebGL basketball game with hand-written verlet physics for the net. SmileTune is a tuner with real-time pitch detection written from scratch (radix-2 FFT autocorrelation, McLeod NSDF, parabolic interpolation).
CapacitorSwift
Security & Systems
SentinelIQ
github.com/karimsangid/sentinel-iq
Security log analytics & anomaly detection
- Normalizes syslog, Windows Events, CEF, and JSON/CSV logs into one schema, embeds them in ChromaDB, and scores the timeline three ways: embedding distance, frequency z-score, and severity escalation. An LLM turns plain-English questions into search filters, with semantic search filling in when few events match. React/WebSocket dashboard, packaged with Docker Compose.
PacketScope
Network protocol analyzer
- Captures live traffic through Npcap's wpcap.dll via ctypes with no third-party dependencies, decodes Ethernet/VLAN and ARP up through DNS, DHCP, HTTP, and TLS SNI, reassembles TCP streams, and flags port scans and SYN floods.
Python stdlibNpcap via ctypes
Technical Skills
AI / ML
LLM agents & tool callingRAG & vector searchEvals & A/B testingLLM-as-judgeFine-tuning (LoRA / QLoRA)Quantization (NF4, GGUF)Structured output (JSON schema)Grounding, guardrails & prompt-injection defenseSpeech-to-text (Whisper)PyTorchHugging Face TransformersPEFTOllamaChromaDB
Languages
PythonTypeScriptJavaScriptC#SQLSwiftBash
Software
FastAPINode.js / ExpressREST APIs & JSONNext.js 16React 19React Native / ExpoTailwindThree.js / WebGLWebSocket / SSEPostgreSQL (RLS, RPC)StripeJestPlaywrightUnit & integration testing
Cloud / DevOps
Git / GitHub ActionsCI/CDDocker / ComposeMicrosoft AzureVercelNetlifySupabase Edge FunctionsTailscale
Security
SIEMVulnerability assessmentPenetration testingSandboxing & least privilegeNIST 800-53 / 800-171FIPSFedRAMPSecure coding
Systems & HW
Linux (RHEL)SSH / PuTTYRabbitMQFirmware build & factory updateTCP/IP networkingProtocol analysis (Npcap)GPU / CUDASite surveys & structured cabling
Education & Certifications
Master of Science, Computer Science (in progress)
George Mason University · Fairfax, VA
CompTIA Security+
AZ-204 Microsoft Certified: Azure Developer Associate
GMU Ethical Hacking Certificate · 2020
PY Python Programming Certificate
C# C# Development Certificate