Marek Kacprzak.
Backend-leaning full-stack engineer building secure, observable systems.
What I do.
As Brand Technical Specialist at IBM, I contribute to technical sales through tailored consultations, solution prototypes, and product demonstrations — aligning customer needs with enterprise software solutions to provide effective technical sales support. In parallel, I lead engineering and security for a confidential automation platform as Head of Software Development and Security, owning architecture, infrastructure, and on-call across the stack.
Currently pursuing an Engineer's degree in Computer Science at SGGW (Warsaw University of Life Sciences) with a specialisation in Cybersecurity, I bring a strong technical foundation to both roles. My multilingual abilities in Polish, English, and Spanish complement my experience in software development and enterprise solutions, enabling effective collaboration with diverse teams and global clients.
Previously, I engineered software end-to-end as a Full Stack Web Developer — from database design through API deployment to UI polish. I'm comfortable across databases, APIs, UX/UI, and CI/CD pipelines, and I deploy projects using virtualisation and container technologies. Alongside the engineering, I'm actively deepening my cybersecurity practice — currently through hands-on work on AI-driven code analysis pipelines and smart-contract security research.
Things I've worked on.
Connexio.pl
Jan 2026 — Apr 2026API-first platform standardising a Transit Connectivity Index for the Warsaw metropolitan area.
Full-stack platform from architecture through deployment — FastAPI over PostgreSQL/PostGIS, Valhalla and OTP routing engines generating isochrones, a Scikit-learn pipeline computing weighted TCI scores, and an Angular frontend with MapLibre GL JS maps and D3.js radar charts. Containerised end-to-end with Redis caching keeping P95 under 300ms on geospatial scoring endpoints.
- Python (FastAPI)
- PostgreSQL / PostGIS
- Angular
- Valhalla / OTP
- Scikit-learn
- MapLibre GL JS
- Redis
- Docker
Show detailsHide details
API-first platform establishing a standardised Transit Connectivity Index (TCI) for the Warsaw metropolitan area. I owned the full lifecycle — from architectural specification to deployment of a containerised data processing engine — prioritising long-term stability and high-performance geospatial analysis.
Technical Architecture & Strategic Planning
- Master Plan Execution: Authored and executed a comprehensive implementation plan, delivering a four-phase roadmap that integrated spatial databases, ML pipelines, and interactive visualisations.
- System Design: Architected a robust stack using Python (FastAPI), PostgreSQL with PostGIS, and Angular, ensuring strict typing and high throughput for both B2C and B2B applications.
- Infrastructure Orchestration: Implemented a fully containerised environment using Docker Compose and Nginx, ensuring strict environment parity and easy portability across cloud providers.
- Performance Optimisation: Configured dedicated Linux infrastructure and Redis caching to achieve P95 response times under 300ms for complex geospatial scoring endpoints.
Development & Operational Excellence
- Data Pipeline Engineering: Developed Python ETL scripts for automated GTFS and OSM data ingestion, maintaining high data integrity through scheduled update cycles.
- Geospatial & ML Logic: Deployed and linked Valhalla / OTP routing engines within Docker to generate accurate isochrones, integrating a Scikit-learn pipeline to compute weighted TCI scores.
- Frontend & Visualisation: Built a responsive Angular application featuring interactive MapLibre GL JS maps and D3.js radar charts for advanced connectivity metrics.
Academic Neighbour
Oct 2025 — Nov 2025Real-time social networking platform for dormitory ecosystems.
Full-stack platform with a FastAPI + SQLModel backend over PostgreSQL, JWT auth, and native WebSocket integrations in both FastAPI and Angular driving live chat and dynamic feeds. Angular v20 SPA with strict typing, Tailwind, and Angular Material. Deployed on Oracle Cloud ARM with Docker Compose and Traefik handling automated SSL and reverse proxying; Devcontainers and GitHub Actions for a reproducible team workflow.
- Python (FastAPI)
- SQLModel
- PostgreSQL
- Angular
- WebSockets
- Docker
- Traefik
- Oracle Cloud
Show detailsHide details
Real-time social networking platform built for dormitory ecosystems. I focused on a scalable architecture balancing high-performance backend logic with a modern responsive UX, while maintaining a robust and automated infrastructure.
Full-Stack Engineering & Real-Time Systems
- Backend Architecture: Developed a high-performance backend using Python (FastAPI) and SQLModel, implementing complex PostgreSQL schemas and secure JWT-based authentication.
- Frontend Development: Built a modular SPA using Angular v20 with strict typing, Tailwind CSS, and Angular Material for a polished, responsive interface.
- Real-Time Communication: Implemented live chat and dynamic updates by engineering native WebSocket integrations within both FastAPI and Angular services — no Socket.IO shortcut.
- Feature Orchestration: Designed and delivered core platform modules including dynamic content feeds, event management, and administrative profile controls.
Infrastructure & DevOps Excellence
- Cloud Orchestration: Deployed containerised infrastructure on Oracle Cloud (ARM) using Docker Compose and Traefik for automated SSL management and reverse proxying.
- Automated Workflows: Established a modern DevOps pipeline using GitHub Actions for CI/CD, ensuring consistent and reliable feature delivery.
- Development Standardisation: Implemented Devcontainers to give the team a unified, reproducible development environment — eliminating configuration drift.
- Security & Performance: Optimised database queries and container resource allocation to ensure high availability and data integrity across the network.
Nest.js Analytics API with BigQuery
May 2025 — Dec 2025Typed, cost-aware analytics endpoints over a warehouse-scale dataset.
Modular Nest.js + TypeScript backend with DTO validation, OpenAPI-from-code, and a BigQuery query layer that prunes partitions and caches in Redis to keep scan costs predictable. Tested with Jest, supertest, and Playwright across the pyramid.
- Nest.js
- TypeScript
- BigQuery
- PostgreSQL
- Redis
- Jest
- Playwright
- OpenAPI
Show detailsHide details
Self-directed Nest.js + TypeScript backend exposing typed, cost-aware analytics endpoints over a warehouse-scale BigQuery dataset. I owned the full lifecycle from schema and API design through testing and deployment, prioritising strict typing, query economics, and a defensible test pyramid over feature velocity.
API Design & Architecture
- Modular Nest.js Layout: Controllers, services, and providers with clear boundaries and dependency injection — easy to extend without leaking concerns across layers.
- Strict Typing: TypeScript end-to-end with DTO validation (class-validator) at every request boundary, so malformed inputs are rejected before they touch a query.
- API Contract: OpenAPI specs generated directly from the codebase, keeping the contract in lock-step with the implementation.
BigQuery Query Layer & Performance
- Cost-Aware Queries: Partition-pruning by date, column projection, and bounded pagination so each endpoint has a predictable scan cost rather than an open-ended bill.
- Injection-Resistant: Parameterised queries with type-checked bindings — no string interpolation into SQL.
- Redis Caching: Result caching with per-endpoint TTLs and cache keys derived from validated DTOs, so hot dashboards stop re-billing BigQuery for identical reads.
Testing & Operability
- Test Pyramid: Jest unit tests for service logic, supertest integration tests against a Dockerised PostgreSQL for metadata, and a Playwright suite covering auth and dashboard end-to-end.
- Containerised: Docker Compose for local parity with deployed environments; structured logging for traceable production debugging.
Passkey Wallet
Aug 2025 — Feb 2026ERC-4337 v0.7 smart wallet with WebAuthn passkey signatures and a sponsor paymaster.
Smart wallet that dispatches signature validation across an ECDSA path (EOA owner) and a WebAuthn passkey path (secp256r1 via the RIP-7212 precompile with a fallback verifier). A fail-closed Hono sponsor service signs paymasterAndData bound to chainid + paymaster address to block cross-chain replay. Tested end-to-end with Foundry against real entryPoint.handleOps, plus Playwright driving Chromium's virtual WebAuthn authenticator via CDP.
- Solidity
- ERC-4337
- Foundry
- WebAuthn
- Next.js
- viem
- Hono
- Playwright
Show detailsHide details
ERC-4337 v0.7 Passkey Wallet — a smart wallet that accepts an EOA owner (secp256k1) or a WebAuthn passkey (secp256r1), with gas paid by an off-chain-signed sponsor paymaster. The Coinbase Smart Wallet pattern, built end-to-end.
ERC-4337 v0.7 Contracts
- PasskeyAccount: BaseAccount-derived, dispatches signature validation to either an ECDSA path or a WebAuthn path that calls the RIP-7212 P-256 precompile with a fallback verifier. UUPS-upgradable, gated to address(this) or the EntryPoint.
- PasskeyAccountFactory: CREATE2 + ERC-1967 proxy. Idempotent — a second call with the same salt returns the same proxy without reverting.
- SponsorPaymaster: Verifying paymaster signed under (validUntil, validAfter); digest bound to chainid + paymaster address to block cross-chain / cross-paymaster replay.
- Test Coverage: 11 Foundry tests via real entryPoint.handleOps calls, asserting AA24 / AA32 / AA34 EntryPoint reverts for the failure paths.
Off-Chain Sponsor Service
- Hono Server: Holds the sponsor key; allowlist policy is fail-closed (empty allowlist → 403). Authoritatively decides what gets sponsored, with no implicit defaults.
- Signature Layout: Signs paymasterAndData in the v0.7 layout (paymaster | gas limits | validity | sig) — sign.ts mirrors SponsorPaymaster.getHash() exactly so any drift surfaces in on-chain verification, not in production.
- API Documentation: Hand-written OpenAPI 3.0 spec, Redocly-linted in CI; 4 vitest tests covering signing, allowlist, fail-closed, and malformed-body paths.
Next.js Dashboard
- Wallet Stack: wagmi v2 + RainbowKit + viem v2. Counterfactual address derivation via factory.getAddress (view call, free).
- WebAuthn Enrolment: navigator.credentials.create() with ES256, exporting the P-256 (x, y) the on-chain account stores.
- E2E Testing: 10 Playwright tests including passkey enrolment driven through Chromium's virtual WebAuthn authenticator via CDP — proves the full enrolment → public-key-export round-trip, not just stubs.
Headless Browser Scraping Toolkit
Jun 2024 — CurrentGo-orchestrated scraping framework hardened against modern anti-bot defences.
- Go
- Playwright
- Puppeteer
- Redis
- MySQL
- Docker
- Prometheus
Show detailsHide details
Self-directed scraping framework built around Playwright and Puppeteer with a Go control plane — the project where I keep my anti-bot and stealth muscle in shape outside client work. Built for sustained success rates over raw throughput.
Stealth & Anti-Bot Engineering
- Fingerprint Hardening: Browser-profile randomisation covering WebGL, canvas, timezone, locale, and plugin-list signals, tuned against a curated set of known anti-bot fingerprinting probes.
- Stealth Tooling: Integrated and extended stealth plugins for Playwright and Puppeteer, eliminating automation tells that off-the-shelf libraries miss.
- Networking Layer: Residential and datacentre proxy rotation with per-proxy health scoring, per-domain request pacing, and TLS-fingerprint awareness to blend with organic traffic.
- Hostile Targets: CAPTCHA escape hatch and adaptive retry policies for sites that escalate defences mid-session.
Reliability & Operational Excellence
- Worker Orchestration: Go control plane scheduling Playwright / Puppeteer workers behind a Redis-backed queue, with retry / backoff (jitter), per-page timeouts, and screenshot-on-failure for forensic debugging.
- Observability: Prometheus metrics scoped per target — success rate, latency, and proxy health are visible per domain rather than aggregated into one useless number.
- Persistence & Scaling: MySQL for run metadata, Redis for in-flight state, stateless workers so capacity scales horizontally with proxy budget.
- Infrastructure: Fully containerised via Docker for environment parity between local debugging and production runs.
Build Management System
2026 — CurrentSecurity-first build orchestration with secrets handling baked in.
- Node.js
- TypeScript
- Python
- Nginx
- Docker
- HMAC-SHA256
- Linux
Show detailsHide details
Centralised Build Management System and Dashboard orchestrating complex compilation workflows — bridging high-level administrative control with low-level server security to keep a stable environment for automated game builds and real-time infrastructure monitoring.
Full-Stack Dashboard & API Development
- Administrative Interface: Engineered a modern, responsive dashboard with real-time health metrics.
- Management API: Custom management API handling atomic configuration writes, automated backups, and path validation to prevent path-traversal vulnerabilities.
- Build Orchestration: One-click build triggering with advanced concurrency control and a queueing engine for simultaneous resource-intensive tasks.
- Real-Time Monitoring: Services panel reflecting live status of the Build Server API, Discord bots, and Wine environments — immediate visibility into system health.
Infrastructure, Security & DevOps
- Hardened Server Environment: Secured the build infrastructure with UFW rules isolating network traffic to admin-only ranges.
- Security Protocols: HMAC-SHA256 signature system for all requests, with environment sanitisation to protect master secrets from build scripts.
- Logging & Persistence: Resilient logging via .jsonl persistence and automated data scrubbing so sensitive material like PATs and API secrets never surfaces in activity tabs.
- Automated Failure Recovery: Timeout protection and automated build termination logic prevent hung processes from consuming server resources.
Multi-Chain DApp
Jan 2026 — CurrentWeb3 onboarding and NFT marketplace across EVM, Sui, and Solana.
- Next.js
- TypeScript
- Solidity
- Move
- ethers.js
- viem
- Foundry
- The Graph
- IPFS
Show detailsHide details
Self-directed multi-chain DApp applying production-grade web dev and security discipline, with blockchain as the new integration surface.
Frontend & Wallet Connector Layer
- Type-Safe Stack: Next.js + TypeScript frontend with responsive UX patterns lifted from production Angular / React work.
- Modular Wallet Connectors: Unified connector layer across MetaMask, Phantom, WalletConnect, and Sui Wallet — chain-aware routing without hardcoding wallet-specific quirks at the call site.
Smart Contracts & On-Chain Logic
- EVM: Solidity ERC-721 contracts via ethers.js and viem; The Graph for event indexing.
- Sui: Move modules using @mysten/sui.js for object-centric NFT logic.
- Solana: Explored Solana program calls via @solana/web3.js, covering wallet connection, devnet transfers, and account-state reads.
- Off-Chain Storage: IPFS (Pinata) for NFT metadata, with Arweave evaluated as the permanence alternative.
Security as First-Class
- Signature Verification: SIWE-style signature verification on authenticated actions with replay-protected nonces.
- Hardened RPC Proxy: Rate-limited RPC proxy with HMAC-signed internal APIs — DevSecOps patterns transferred directly from professional infrastructure work.
Testing & Scalability
- Contract Tests: Foundry contract unit tests plus signing-flow integration tests covering authenticated paths.
- Backend Contract: OpenAPI-documented backend routes; layered architecture that scales horizontally behind the RPC proxy.
Smart Contract Security Lab
Jun 2025 — Mar 2026Reproducible exploit PoCs across canonical Solidity vulnerability classes.
- Solidity
- Move
- Slither
- Foundry
- Hardhat
- TypeScript
- Next.js
Show detailsHide details
A catalog of intentionally-vulnerable Solidity contracts paired with verified fixes, static analysis, and a wallet-authenticated PoC dashboard. Every bug is reproducible and every patch provably effective.
Vulnerability Catalog & Exploit Engineering
- Five Classes: Paired Vulnerable.sol / Fixed.sol for reentrancy, signature replay, access control (missing modifier + tx.origin), unchecked-math underflow, and single-block oracle manipulation — modelled on real incidents.
- Differential Foundry Suite: 16 tests where exploits prove the bug and fixes prove the patch closes it — CEI, EIP-712 digest binding, Ownable2Step, checked math, anchor-bounded oracle.
- Static Analysis: Automated Slither runs with curated remappings; committed JSON findings ship with the repo.
- Sui Move Contrast: A safe_vault module showing how Move's linear-resource type system makes several Solidity bug classes structurally impossible.
Dashboard & SIWE Attestation
- Catalog UI: Next.js 14 App Router dashboard hydrating each detail page from contracts/ — live source of both implementations alongside Slither output.
- SIWE PoC API: Two-step EIP-4361 flow — /challenge issues single-use nonces bound to slug + address; /submit verifies via siwe, confirms the signer, records the submission.
- Wallet Integration: wagmi v2 + viem v2 + RainbowKit for MetaMask / WalletConnect.
- API Contract: Hand-written OpenAPI 3.0 spec, Redocly-linted in CI.
End-to-End Test Automation
- Playwright Suite: 13 tests covering catalog UI, API, and a full SIWE round-trip with a real viem-signed message — including a nonce-replay rejection test.
- Verification Gate: forge test (16/16), sui move test (2/2), Redocly lint, npm run build, and Playwright all wired into the documented quickstart.
Glioma Classification
Mar 2025 — Jun 2025Biomedical ML pipeline replicating a 2022 NIH glioma grading methodology from clinical and molecular data.
- Python
- scikit-learn
- PyTorch
- Ensemble Learning
- Feature Selection
- pandas
- Biomedical ML
Show detailsHide details
R&D project replicating a biomedical study for glioma grading using clinical and molecular data. Acted as the bridge between research objectives and technical execution — keeping the ML workflow aligned with rigorous scientific standards and NIH-based methodologies.
Research & Development
- Study Replication: Directed the end-to-end project lifecycle for glioma grading, replicating the source biomedical study through precise feature selection and model evaluation.
- Methodology Compliance: Reviewed project documentation against the 2022 NIH-based reference methodology and scientific protocols to keep results defensible.
- Technical Coordination: Scheduled and oversaw specialised tasks involving ensemble learning (Soft Voting) and predictive modelling for high-fidelity results.
- Specialist Collaboration: Facilitated continuous communication and technical alignment between machine learning specialists and data researchers throughout the study.
Project Governance & Stakeholder Alignment
- Lifecycle Planning: Managed the project roadmap in Jira and Miro, translating research milestones into actionable development tasks and technical sprints.
- Quality Assurance & Documentation: Maintained comprehensive knowledge bases so all research findings and technical implementations were documented for reproducibility.
- Resource & Risk Monitoring: Identified potential blockers in the data processing and modelling phases before they derailed the timeline.
Sky Clustering
Mar 2025 — Jun 2025Computer vision pipeline clustering high-volume frame data from vehicle-mounted cameras.
- Python
- OpenCV
- NumPy
- Clustering
- Matplotlib
- Plotly
- Computer Vision
Show detailsHide details
Multidisciplinary computer vision project analysing video telemetry from vehicle-mounted cameras. Bridged data-science experiments and structured project delivery so technical breakthroughs translated cleanly into reports for academic and external stakeholders.
Technical Project Control & Agile Leadership
- Sprint & Milestone Management: Directed the project lifecycle using Agile methodologies, planning sprints and tracking milestones across data preprocessing and cluster analysis phases.
- Workflow Optimisation: Identified and resolved technical bottlenecks so the pipeline for analysing high-volume video frame data stayed seamless.
- Tooling & Infrastructure: Introduced and managed the technical ecosystem — Jira, GitHub, and ProjectLibre — to maintain structured collaboration.
- Resource Coordination: Led a diverse team of specialists, aligning their efforts with strategic goals and ensuring optimal task distribution throughout the research cycle.
Stakeholder Management & Technical Reporting
- Results Visualisation: Translated complex clustering experiment results into clear, data-driven visualisations for presentation to external academic stakeholders.
- Documentation Excellence: Established rigorous documentation standards so all research findings and technical configurations were archived and reproducible.
- Quality Oversight: Monitored the integrity of data analysis workflows, ensuring results met the standards expected by academic partners and industry collaborators.
Academic Research Database Comparator
Oct 2024 — Feb 2025Centralised platform comparing research outputs across Polish university databases.
- Python (FastAPI)
- PostgreSQL
- Angular
- Web Scraping
- Data Integration
- Docker
- GitHub Actions
Show detailsHide details
Centralised platform comparing academic research outputs across various Polish university databases. Synchronised technical workflows with academic requirements through structured team leadership and transparent stakeholder management.
Project Governance & Team Leadership
- Workflow Organisation: Directed a multidisciplinary team by establishing clear operational frameworks, running regular sync meetings, and managing the end-to-end project lifecycle.
- Strategic Task Planning: Used Jira to plan and track complex tasks, keeping development aligned with the project roadmap and technical specifications.
- Specialised Delegation: Assessed team members' technical strengths and delegated tasks accordingly, providing mentorship to maintain high standards of execution.
- Resource Management: Used ProjectLibre and Miro to create detailed timelines and visualise project architecture, preventing bottlenecks in the data integration phases.
Stakeholder Management & Delivery
- Academic Alignment: Acted as the primary liaison for university stakeholders, making sure the platform met the rigorous data comparison standards required by academic institutions.
- Documentation & Reporting: Authored and maintained comprehensive project documentation as a clear audit trail of technical decisions and platform capabilities.
- Presentation of Results: Delivered final project outcomes and platform demonstrations to academic boards, highlighting the tool's impact on research visibility and data accessibility.
Where I've worked.
IBM
Full-time · Warsaw — HybridBrand Technical Specialist
Jan 2026 — CurrentHands-on technical specialist designing viable client solutions across IBM's automation portfolio. Articulate value proposition and ROI, navigate the competitive landscape, and deliver technical proof points — demos, POTs, POCs, workshops, solution designs, and MVPs — to remove technical inhibitors from enterprise sales cycles.
Pre-sales Engineer
Oct 2025 — Dec 2025Technical bridge between IBM's product capabilities and enterprise customer requirements. Designed PoCs, led workshops and demos, owned the technical workstream on RFP / RFI responses, and supported the sales cycle from discovery through close.
Confidential Client
Self-employed · Warsaw — RemoteHead of Software Development and Security
Jan 2026 — CurrentEnd-to-end engineering and security ownership for an infrastructure automation platform. Lead architectural governance, ship backend API and integration work, and run multi-cloud deployments (AWS / GCP / Azure) via CI/CD. Spearhead AI-driven code and infrastructure analysis pipelines for proactive vulnerability detection; own the monitoring, logging, and 24/7 observability story.
Software Mind
Full-time · Warsaw — HybridJunior Delivery Manager
Jun 2025 — Sep 2025Cross-functional delivery and project management for complex web applications across fintech, SaaS, and public sector clients. Owned end-to-end delivery cycles, SLA monitoring, agile sprint planning, and client relationships. Drove internal automation (leave management, wikis, schedules), managed budgets and PMO-ready financial reports, and ran onboarding across Netherlands–Poland teams.
Weblo
Full-time · Warsaw — On-siteProject Manager
Apr 2025 — Jun 2025Delivery and project management for WordPress / WooCommerce eCommerce builds. Drove the full lifecycle from scoping through deployment, owned risk planning and design-to-code QA, and served as the primary client contact translating business needs into technical requirements.
OSEC — Open Source Education Center
Part-time · Warsaw — HybridIT Project Manager
Apr 2024 — Jun 2025Project management for the Allegro-seller analytics platform. Ran an Agile / Waterfall hybrid, prioritised the backlog, coordinated code reviews and architectural audits, and owned releases across cloud environments — Jira and Azure DevOps for transparent client reporting.
Full Stack Developer
Mar 2024 — Apr 2025Full-stack engineering for the Allegro-seller analytics platform — Go APIs (Huma, Gin) over PostgreSQL, an Angular + Tailwind frontend, and a fully-featured browser extension via WXT extending platform functionality directly into seller workflows. Operated Docker / Kubernetes environments with CI/CD for reliable deployment.
Tools I reach for.
- Backend & Languages
- Node.js (Nest.js, Express) · TypeScript · Go (Huma, Gin) · Python (FastAPI) · Rust
- Data & Streaming
- PostgreSQL · MySQL · BigQuery · Redis · Kafka · pgvector
- Cloud & Deployment
- AWS (Lambda, ECS, S3) · GCP · Azure · Kubernetes · Docker · GitHub Actions
- Observability & Testing
- Prometheus · Grafana · Sentry · ELK · Jest · supertest · Playwright
- Security
- Threat modelling · Secure API design · HMAC request signing · Container hardening · OWASP
- Frontend
- React · Next.js · Angular · Tailwind CSS · Browser extensions (WXT)
Let's talk.
The best way to reach me is email. I'm most interested in backend-leaning roles with strong engineering peers and a product I can take ownership of.
- GitHub
- navitelogger
- marek-kacprzak
- Based in
- Warsaw, Poland