Staff Software Engineer / Platform & Applied AI

Architecture for a multi-tenant, white-label insurtech platform.

I am Kamyar, a Staff Software Engineer with six years at Finlex, a regulated insurtech platform, where I own architecture across a multi-tenant, white-label stack and was part of the team that took a multi-agent system on Amazon Bedrock to production. Outside work, I designed, built and run Receipts Manager alone.

Email me Download CV GitHub
Profile Open to new roles
Kamyar Shahrestani Staff Software Engineer · Platform & Applied AI
Now
Staff Software Engineer at Finlex, a regulated insurtech platform in Frankfurt, since April 2020
Building
Receipts Manager, a side project outside work, live with real users
Based
GermanyIrelandGerman citizen with an EU passport, so no visa or sponsorship in either place.
Open to
Staff and Principal engineering roles
shahrestani.me
  • Six years at Finlex

    Senior Solution Engineer, then Technical Lead for the frontend, then Staff Software Engineer. I own architecture across the stack of a multi-tenant, white-label insurtech platform.

  • Production AI

    Part of the team that took a multi-agent AI system from concept to production on Amazon Bedrock, in one of Europe’s most heavily regulated industries.

  • Side project

    Receipts Manager, live with real users: an MCP server with 46 tools behind its own OAuth 2.1 authorization server, and a Google ADK agent on Vertex AI (Gemini).

Background

Where the years went.

Senior developer, then technical lead, then Staff Engineer. The same arc each time: own the system, keep it correct under real load and real regulation.

  1. April 2020 to nowcurrent

    Staff Software Engineer, Platform ArchitectureFinlex GmbH, Frankfurt

    Senior Solution Engineer (2020) → Technical Lead, Frontend (2020–2022) → Staff Software Engineer (2023–present)

    Part of the team that took a multi-agent AI system from concept to production on Amazon Bedrock, in one of Europe’s most heavily regulated industries.

    Own architecture across the stack of a multi-tenant, white-label platform — TypeScript and React micro frontends through Ruby, Node and Python services.

    Led six cross-team projects across application, policy and quote-to-bind, including an org-wide migration from Bitbucket to GitHub across five teams that carried a repository naming standard, CI and AI-assisted code review with it.

    Built a role-aware renewal portfolio dashboard on event-driven aggregation over SNS/SQS with MongoDB pipeline tuning; rebuilt a legacy Angular contract view as a React micro frontend.

    Drove error-signal quality across platform services — log-level hygiene, source maps for crash localisation, bounded retry for transient failures, and removing PII from payload logging.

    Owned and built Night Agent, an internal multi-agent coding system (private repository) that reports to a real test suite: each task runs in its own worker and git worktree, and only work that passes the project’s test command merges. Built to solve specific Finlex problems; one of several recent pieces of my work there, not the centre of it.

  2. December 2018 to December 2019

    Senior Full Stack Web DeveloperJob Frame GmbH, Mainz

    Built Angular applications test-first, reducing defects by 30%.

    Developed APIs with .NET Core and MongoDB; deployed to Azure with full CI/CD automation.

  3. 2011 to 2018

    Senior Developer and Technical DesignerVarious companies, Tehran

    Led full-stack delivery of booking platforms and financial tooling across finance, travel and e-commerce (ASP.NET, Angular, SQL Server, Power BI).

B.Sc. Computer Engineering, Azad University, Karaj, degree recognised by ZAB. German citizen with an EU passport, so no visa or sponsorship question anywhere in the EU. English: full professional proficiency. German: professional working proficiency.

TypeScript, Python, Ruby, C# / React, React Native, Expo, Angular, Nx monorepos, Tailwind CSS / FastAPI, Node.js, NestJS, .NET Core, REST, GraphQL / Firestore, MongoDB, SQL Server / GCP (Cloud Run, Secret Manager, Workload Identity Federation, Artifact Registry), AWS (Bedrock, SNS/SQS), Azure, Kubernetes, GitHub Actions, Docker, Datadog / MCP, Google ADK, Vertex AI Agent Engine, Gemini, Amazon Bedrock, LangGraph, agent eval suites in CI / OAuth 2.1, PKCE, least-privilege IAM, tenant isolation, audit logging / pytest, Jest, Cypress, Playwright / multi-tenant white-label platforms, Domain-Driven Design, Clean Architecture, micro frontends / IaC through AI coding tools (Terraform, provisioning scripts)

Side project

Outside work: Receipts Manager.

A personal-finance product I designed, built and run alone, live with real users. I own it end to end, from the data model to the CI/CD that ships it. Open the card for the full story.

Side project, solo-built

Receipts Manager

Personal-finance product, live with real users · receipts-manager.com

Narrated walkthrough · 2 min · captions availableWhy household expense tracking fails, who Receipts Manager is for, and how it works on the Android app from an empty account to a full month: currency, budgets and categories, a receipt photo read by Gemini, an expense added by one sentence, a pasted bank export, spending in pounds, rent and subscriptions, income, the monthly picture and a PDF report. More guides, including using it from Claude, are on the YouTube channel.

Household expense tracking fails for the same reason every time: the data entry is tedious enough that people stop doing it. Receipts Manager removes the typing. An agent reads the receipt, and a household shares one picture of where the money actually went.

  1. i

    Capture without typing.Photograph a receipt and Gemini reads the image directly, extracting merchant, line items and the tax breakdown. Expenses can also be added by voice or prompt in the app, or sent in bulk by an outside AI agent over MCP, which reads a bank CSV or statement and submits the rows.

  2. ii

    An API other agents call.An MCP server with 46 tools over remote HTTP, with its own OAuth 2.1 authorization server (PKCE, dynamic client registration, rotating tokens). Tool calls reuse the same auth, scope, rate-limit and audit path as the REST API.

  3. iii

    Agent runtime.A Google ADK agent on Vertex AI (Gemini), acting as the user through short-lived per-session tokens, with SSE streaming; statement imports are staged for the user to confirm. Extraction costs about $0.003 per receipt and the region serves first byte in about 0.10 s; every turn logs its cost and latency.

  4. iv

    Delivery and operations.A GitHub Actions pipeline with tests as a gate (about 3,500 backend, 1,000 app), two isolated GCP environments, Workload Identity Federation with no stored keys, least-privilege IAM, and an agent eval suite with 27 pass/fail gates on every pull request.

Live with real users and run alone: an MCP server with 46 tools behind its own OAuth 2.1 authorization server, and a Google ADK agent on Vertex AI (Gemini) gated by agent evals on every pull request.

Python / FastAPI / GraphQL / MCP / OAuth 2.1 / Google ADK / Vertex AI / Gemini / Firestore / Cloud Run / GitHub Actions / Docker / Expo, React Native / TypeScript

Visit receipts-manager.com Video guides on YouTube Ask me about it
  • Receipt details after a photo scan: eight line items, the 7% and 19% VAT bands and a €28.18 total.
    A photographed receipt, read into items and both VAT bands.
  • The in-app assistant turning “Lunch at Trattoria Da Marco yesterday, 23.50 euros” into a filed expense with an Undo button.
    One sentence to the assistant becomes a filed expense, with undo.
  • The month view: €1,586.64 spent, 41% of €3,850 income, with the expense list below.
    The month at a glance: spending as a share of income.
  • Expenses by category as a donut chart, led by Housing & Living at 78.7%.
    Receipts and recurring costs, broken down by category.

How I build

Four rules I hold to.

  1. i

    Verification beats vibes

    An exit code is the only thing in an agent loop that cannot be talked into agreeing with you. Wherever a model can grade its own homework, it eventually will.

  2. ii

    Scope is a feature, not a guardrail

    Narrowing a session narrows the prompt and the credential together. Accuracy, least privilege and cost all improve from a single decision, made once, at the point a session opens.

  3. iii

    Leave the human on the commit

    Propose then confirm, everywhere the input is attacker-influenceable. Design so that total model compromise still only produces a suggestion someone declines.

  4. iv

    Build with the thing you build

    My own workflow runs on coding agents: tickets planned in the tracker, work dispatched to subagents in separate worktrees, merges gated on CI. Every pattern on this page runs in my own repositories first.

Taking AI from prototype to production.

Most teams have a prototype that works in a demo and a list of reasons it cannot go in front of customers. Working through that list is the part of the job I care most about. These are the four things I set up first.

Email me
  1. 01

    A first production agent

    From prototype to something you can widen access to safely: session scoping, a credential the agent cannot leak, propose then confirm for anything that writes, and rollout gates you can actually hold.

  2. 02

    An API as a tool surface

    MCP over the service layer you already have. OAuth 2.1 with discovery, scopes, rate limits, idempotent writes and an audit trail. Existing clients keep working while the agents arrive.

  3. 03

    EU residency and retention, decided and written down

    Which region, what the model may keep and for how long, whether a new vendor is allowed in. Recorded as decisions a data protection officer can read, not as a hope.

  4. 04

    Cost, evals and vendor independence

    Token caps that return a clean error instead of an invoice, an eval gate before each release, and a provider layer so moving between model vendors is a configuration change.

Tell me what you are building.

info@shahrestani.me GitHub LinkedIn CV (PDF)

Open to Staff and Principal Engineer, Applied AI and AI Agent Engineer, and Platform Architecture roles: technical leadership and system ownership rather than people management. Based in Germany and in Ireland, available in both.