Jean-Luc WilliamsSecure Systems Engineering & Cognitive Design
Software engineer with 6+ years across customer identity, cloud infrastructure, and enterprise backend systems — three of them hardening CIAM for a Fortune 500 hospitality company. Backed by an M.S. in Cyber Security (NSA CAE-CD) and a background in Cognitive Engineering, I turn ambiguous requirements into secure, measurable outcomes.
I Build Things to Find Out How They Work
I started college intending to study electrical engineering — I wanted to understand systems all the way down, to the trace on the board. I finished at RPI in Information Technology & Web Science with a concentration in Human-Computer Interaction and Cognitive Engineering, which turned out to be the same curiosity pointed one layer up: not just how a system works, but how it behaves for the person on the other side of it.
Professionally that landed me where authentication meets everything else — the guest login that has to succeed, the service token that has to be valid, the API gateway that has to hold. Unglamorous infrastructure people only notice when it breaks. Paired with an M.S. in Cyber Security from NYU, it means writing code with the failure modes already in mind, whether that is restoring services during a security incident or standardizing how a dozen services validate a token.
The side projects are the same instinct off the clock: a costing SaaS for restaurants, a fighting-game engine with rollback netcode, soldered hardware, printed parts. I build them either to make something easier for the people who’d use it, or just because I love the thing itself and want others to enjoy it too. This site is where they collect.
Capabilities Matrix
Core StackIdentity & Access
OAuth 2.0, OpenID Connect, JWT/JWKS, IAM, Okta, Auth0, Apigee X, token and session lifecycle design, CPRA compliance.
Security
Burp Suite, OWASP ZAP, Ghidra, Wireshark, Kali Linux, Pwntools, IPS rule writing, Akamai, Cloudflare.
Cloud & DevOps
AWS, Google Cloud (GCP), Microsoft Azure, Terraform, Docker, GitHub Actions, Azure DevOps, Git, Heroku.
Languages
Python, Java, Node.js, Go, TypeScript, JavaScript, Dart, C, C++, Bash, PowerShell, SQL, Apex.
Backend & Data
GraphQL, REST API design, PostgreSQL, MongoDB, Redis, Google Firestore, Supabase.
Front-End
React, Next.js, Flutter, Tailwind CSS, HTML5, CSS3.
Featured Projects & R&D
Active Build LabFood Cost Guide — Restaurant Costing SaaS
Solo-designed and shipped a multi-tenant SaaS for restaurants, modeled as teams that own fully independent per-location datasets. A user-managed vendor Cost Guide prices recipes live — sell price, food cost %, labor cost, profit margin — against per-location, color-coded metric thresholds, with sales, purchasing analytics, and inventory tooling on every tier. Postgres row-level security is the real trust boundary: every location-scoped table resolves access through one shared predicate. Layered on top: Stripe subscription billing with per-location line items, soft tier-limit locking that never deletes a lapsed subscriber’s data, branded PDF exports with live-preview palette editors, country geo-blocking, GDPR cookie consent, self-serve data export and deletion, Sentry monitoring, and Redis-backed API rate limiting — all under a no-mock Supabase integration test suite. Ships as an installable, offline-capable PWA.
Edibubble — Social Network
A foodie social network in Flutter (Riverpod, go_router) — discover restaurants and recipes, build and share curated lists, follow other users. Backed by a self-hostable Supabase stack with the full schema, row-level-security policies, functions, and triggers version-controlled as SQL, and an integration suite that exercises them against real Postgres instead of mocks. Includes a custom map view with collision-laid-out restaurant marker labels and bounded-batch geo queries.
Rollback Fighting Engine
A from-scratch 2-D fighting game in Unity/C#, its two-lever controls taken from the 1984 arcade game Karate Champ and modernized — a real block button replacing the original's exploitable one, plus bluffable charge-and-commit attacks. A fully deterministic fixed-point simulation (no UnityEngine dependency, one blittable state struct) underpins hand-rolled rollback netcode that stays byte-identical through a 5,000-tick randomized-rollback sync test and a 95%-packet-loss simulation. Playable local 2-player versus today, plus a training mode with reactive dummy AI and a custom keyframe/hitbox animation tool.
Untitled Quadruped Physics Game
A QWOP-inspired physical-comedy game for dogs: players drive each leg independently through ragdoll/procedural physics in Unity, trading precise control for the same glorious, chaotic failure states that made the original a classic — reimagined for four legs instead of two.
Hardware & Maker Lab
Physical IoT and hardware security builds, including assembling and soldering a Slim Pwnagotchi for network auditing, plus custom CAD models and 3D-printed structural components for multi-part assemblies.
Professional Experience
6+ YearsFounding Software Engineer
Fletcher Jones Management GroupApr 2025 – May 2026
- Founded the company's first internal software engineering team, transitioning ownership of a six-year enterprise platform away from external contractors and cutting new-engineer ramp-up from weeks to days through authored runbooks and deployment documentation.
- Architected CI/CD pipelines in GitHub Actions, automating deployments across environments and giving the executive suite real-time visibility into release status.
- Partnered directly with the CTO to map the company's technology landscape and define a multi-year roadmap for enterprise-wide stack consolidation.
- Instituted technical auditing of external vendor deliverables and standardized deployment practices across 10 locations, reducing configuration drift; optimized core platform logic to recover 5%+ of usage limits, extending the runway of existing architecture without a costly re-platform.
Software Engineer, Customer Identity Team
MGM Resorts InternationalJan 2022 – Apr 2025
- Built the guest guided sign-in experience and redesigned surrounding identity flows, driving a 27% increase in login success and a 25.7% increase in account activation while eliminating the top recurring guest-reported errors.
- Authored a centralized JWT validation helper adopted across the team's Node.js services, configurable per endpoint by allowed token type (service, guest, anonymous) and required roles or scopes; enforced complete best-practice claim validation — Okta JWKS signature, issuer, audience, and validity windows — closing an IDOR vulnerability found while triaging an on-call alert.
- On a combined Identity and Profile team, floated onto the group's larger projects through repeated stretches without engineering management — resolving GraphQL changes, production debugging, and blockers in partner teams' integrations with our services.
- Authored the modernization architecture for the legacy mobile authentication stack against mobile-team requirements, surfacing an ownership risk that redirected the effort toward a vendor-supported Okta path.
- Modernized identity systems to strict OAuth 2.0 compliance and supported migration from scope-based to service-role-based JWTs across a polyglot stack (Java, Node.js, Python, Dart); consolidated TypeScript services onto Node.js to narrow the maintenance surface.
- Supported multiple teams through recovery from an enterprise-wide security incident: rebuilt the team's AWS environment to restore an undocumented legacy mobile authentication service — its only workload there — that was blocking the recovery timeline, and assisted bring-up of the team's remaining services.
- Manually rotated the Okta client IDs and secrets used by most backend services to mint service tokens, coordinating secure redistribution to dependent teams; reverse-engineered a partner team's Java service to resolve a credential-hashing mismatch blocking reintegration.
- Guided partner teams through Apigee X gateway adoption after it became mandatory post-incident, and diagnosed VPN-related network failures with workarounds that kept development unblocked.
- Established the team's first Dart backend pattern on GCP/Firestore for personalized preferences and targeted offers, which ran without a single production incident from launch through departure; modernized Azure DevOps and GitHub Actions pipelines with parameterized variables, reusable workflows, and atomic components.
- Automated account data reconciliation and CPRA compliance request processing; mentored engineers from non-CS backgrounds on diagnostic technique, testing, and secure development.
Webmaster
Largo Consulting Services, LLCApr 2020 – Jan 2022
- Owned the full lifecycle — design, security, and optimization — of 11 client websites on WordPress and BigCommerce.
- Hardened web systems through proactive threat monitoring and custom IPS rule development, maintaining sub-hour resolution on bugs and vulnerabilities.
- Advised stakeholders on functional and UX improvements using Google Analytics and custom dashboards, informing site roadmaps.