{
  "$schema": "https://raw.githubusercontent.com/jsonresume/resume-schema/v1.0.0/schema.json",
  "basics": {
    "name": "Suleyman Musayev",
    "label": "Senior Staff Engineer · Distributed Systems, Scale, Cryptography, Security",
    "email": "slmusayev+agents@gmail.com",
    "url": "https://msuliq.github.io/",
    "summary": "Senior Staff Engineer working in PKI, cryptography, authentication, high-scale systems, and fraud and abuse defense.",
    "profiles": [
      {
        "network": "LinkedIn",
        "url": "https://www.linkedin.com/in/smusayev"
      },
      {
        "network": "GitHub",
        "url": "https://github.com/msuliq"
      },
      {
        "network": "RubyGems",
        "url": "https://rubygems.org/profiles/msuliq"
      },
      {
        "network": "Stack Overflow",
        "url": "https://stackoverflow.com/users/18576304/msuliq"
      },
      {
        "network": "Medium",
        "url": "https://msuliq.medium.com"
      }
    ]
  },
  "work": [
    {
      "name": "SSL.com",
      "position": "Senior Staff Engineer",
      "startDate": "2023-08",
      "summary": "Sole architect and lead engineer of the authentication, identity, and certificate-issuance platform at a top-10 global certificate authority. I design the distributed services and, because attackers come with the territory, run the fraud and abuse defense too. On this platform the core business scaled 10x.",
      "highlights": ["Sole architect of the company-wide authentication and identity platform (OAuth2, OIDC, SAML, session-based flows, external IdP integrations) serving tens of thousands of daily users; scaled the platform through 10× core business growth across TLS, code signing, and identity certificate issuance.","Distributed-systems work: extracted authentication into its own service with cross-service sessions, built multi-perspective certificate validation (MPIC) with quorum across vantage points, and designed the API servers, async workers, and audit pipelines around them.","Performance at scale: cut backend latency up to 5× and fixed slow API paths by eliminating N+1 queries, a hot-path regex, and a write storm, and by reworking batch polling into per-record jobs.","Correctness in money and state: idempotent billing, atomic multi-step writes, and APIs that stay backward-compatible as they grow.","Fraud, security & abuse: shut down months-long attacker reconnaissance before exploitation; closed account-takeover, second-factor-bypass, and invitation-abuse paths; bot defense at 1,000+ fake signups/day incl. CAPTCHA-farm countermeasures; stopped a four-figure-per-day SMS pumping attack in 4 days; and defeated a persistent session hijacker.","Also built insider-threat and identity-theft detection, pairing LLM-augmented pattern matching with human-led forensics to go from detection to mitigation in minutes, not days."]
    },
    {
      "name": "Midstay",
      "position": "Software Engineer",
      "startDate": "2022-11",
      "endDate": "2024-01",
      "summary": "Early engineer on a 5-person team building a consumer product with ~1k DAU (joined as an intern in Aug 2022). Owned end-to-end features across the Rails stack and led incident response. Final 5 months were a contract wind-down with gradual transition of responsibilities while ramping up at SSL.com.",
      "highlights": ["Closed authorization flaws surfaced in a live penetration test, including a broken access control in a private messaging flow; led incident response against advanced attackers.","Reduced backend latency by up to 5× through query optimization, indexing, and caching.","Improved user retention by 15% through targeted performance and product improvements.","Shipped 4 major product features in 12 months, supporting multiple product pivots."]
    },
    {
      "name": "Private Trading Firm",
      "position": "Quantitative Trading Operations",
      "startDate": "2020-03",
      "endDate": "2021-05",
      "summary": "Built and managed automated hedging strategies across multiple brokers, markets, and financial instruments. Risk modeling under adversarial market conditions is the same discipline as fraud detection: spotting anomalies early, capping losses, and acting fast when the numbers move against you.",
      "highlights": ["Reduced hedging costs by up to 35% through strategy optimization and execution improvements.","Managed a large leveraged portfolio with rigorous risk control and capital efficiency.","Self-taught Ruby in parallel during this role, transitioning to engineering by mid-2022."]
    }
  ],
  "skills": [
    {
      "name": "Languages",
      "keywords": ["Ruby","Go","JavaScript","Python","C","C++","SQL"]
    },
    {
      "name": "Backend & Distributed Systems",
      "keywords": ["Ruby on Rails","Sinatra","Hanami","Service Architecture","REST APIs","Async Jobs","Caching","Rate Limiting"]
    },
    {
      "name": "Frontend",
      "keywords": ["Hotwire","Turbo","Stimulus","React","Tailwind CSS","htmx"]
    },
    {
      "name": "Integrations",
      "keywords": ["Intercom","Slack","Salesforce","Stripe","Webhooks","REST API Clients & Servers","OAuth Provider & Client","OpenAPI","Amazon SES","LinkedIn API"]
    },
    {
      "name": "AI & Models",
      "keywords": ["PyTorch","Hugging Face","LoRA Fine-Tuning","vLLM","llama.cpp","Self-Hosted LLMs","Model Debugging","LLM Evals","MCP Servers"]
    },
    {
      "name": "Data",
      "keywords": ["PostgreSQL","Redis","Elasticsearch","Sidekiq","Kafka"]
    },
    {
      "name": "Auth & Identity",
      "keywords": ["OAuth2","OpenID Connect","SAML","SSO","Passkeys","WebAuthn","Two-Factor Auth","JWT","Session-based","mTLS","reCAPTCHA","Cloudflare Turnstile"]
    },
    {
      "name": "Security & PKI",
      "keywords": ["PKI","Certificate Lifecycle","MPIC","X.509","TLS"]
    },
    {
      "name": "Cryptography",
      "keywords": ["Post-Quantum (ML-DSA)","Memory-hard Hashing","ASN.1/DER","Digital Signatures"]
    },
    {
      "name": "Fraud & Abuse",
      "keywords": ["Fraud Detection","Bot Mitigation","Device Fingerprinting","Behavioral Analytics","Account Takeover Prevention","Insider Threat Detection"]
    },
    {
      "name": "Infrastructure",
      "keywords": ["Docker","Linux","Nginx","AWS","GitHub Actions","Datadog"]
    }
  ],
  "projects": [
    {
      "name": "domain_sanity",
      "description": "Strict domain-name validation the way a certificate authority must: RFC 1035 labels, IDN/punycode, Public Suffix List, CA/Browser Forum wildcard rules, and IP, reserved-range, and reverse-zone detection.",
      "url": "https://github.com/msuliq/domain_sanity",
      "keywords": ["Ruby"]
    },
    {
      "name": "csr_peek",
      "description": "Safe, dependency-free CSR and X.509 certificate inspection - subject, SANs, key strength, weak-signature checks, and a pluggable Baseline Requirements policy.",
      "url": "https://github.com/msuliq/csr_peek",
      "keywords": ["Ruby"]
    },
    {
      "name": "svg_sentinel",
      "description": "Lint or sanitize untrusted SVG - blocks scripts, event handlers, XXE, and external references, with a CLI and SARIF output for CI pipelines.",
      "url": "https://github.com/msuliq/svg_sentinel",
      "keywords": ["Ruby"]
    },
    {
      "name": "omniauth_oidc",
      "description": "OmniAuth strategy for OpenID Connect (OIDC) with first-class support for Microsoft Entra ID and Cloudflare Access.",
      "url": "https://github.com/msuliq/omniauth_oidc",
      "keywords": ["Ruby"]
    },
    {
      "name": "ip_geo_lookup",
      "description": "Lightweight IP geolocation lookup for Ruby - useful for fraud detection, access control, and request enrichment.",
      "url": "https://github.com/msuliq/ip_geo_lookup",
      "keywords": ["Ruby"]
    },
    {
      "name": "balloon_hashing",
      "description": "Implementation of the Balloon memory-hard password hashing algorithm.",
      "url": "https://github.com/msuliq/balloon_hashing",
      "keywords": ["Ruby"]
    },
    {
      "name": "yescrypt",
      "description": "Yescrypt password hashing implementation, the successor to scrypt.",
      "url": "https://github.com/msuliq/yescrypt",
      "keywords": ["Ruby"]
    }
  ],
  "publications": [
    {
      "name": "Rendering User-Supplied SVG Without Getting Burned",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/rendering-user-supplied-svg-without-getting-burned-f0e78d2172f8",
      "summary": "An SVG is not an image, it is a program the browser runs. What can hide in an uploaded avatar or logo, and a small gem that finds it or cleans it out. Companion to svg_sentinel."
    },
    {
      "name": "Memory-Hard Password Hashing in Ruby: Balloon and yescrypt",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/memory-hard-password-hashing-in-ruby-balloon-and-yescrypt-bf928bd58452",
      "summary": "Being slow is no longer enough against GPU farms. A password hash also has to be expensive to remember. Two ways to do that in Ruby, and when to use each."
    },
    {
      "name": "The Attacker Doesn't Need to Know Your Programming Language Anymore",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/the-attacker-doesnt-need-to-know-your-programming-language-anymore-21b451abbb41",
      "summary": "LLMs did not make attackers smarter, they made them cheaper. What your front end tells the world, and why reading it just got easy."
    },
    {
      "name": "Adding OpenID Connect Login to Rails Without the Dependency Pile",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/adding-openid-connect-login-to-rails-without-the-dependency-pile-f8bfffd38e89",
      "summary": "How OpenID Connect actually works, and two small Ruby gems that add \"log in with your work account\" to Rails with almost no dependencies."
    },
    {
      "name": "The Attacker Filed a Support Ticket",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/the-attacker-filed-a-support-ticket-8939e632046d",
      "summary": "Some complaints are not feedback. They are an attack on the people who can turn your defenses off. How to tell a real complaint from a paid one."
    },
    {
      "name": "Post-Quantum Cryptography Is Here: What FIPS 203, 204, and 205 Mean for Engineers",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/post-quantum-cryptography-is-here-what-fips-203-204-and-205-mean-for-engineers-75c1293e2175",
      "summary": "The post-quantum standards are official. The short, practical version of what changed and what engineers should do about it, with no lattice math."
    },
    {
      "name": "Bringing a Post-Quantum Signature into Ruby",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/bringing-a-post-quantum-signature-into-ruby-47878d6bb166",
      "summary": "NIST finalized ML-DSA in 2024, but Ruby had no easy way to use it. So I wrapped it, and the wrapping is where the interesting engineering lives. Companion to ml_dsa."
    },
    {
      "name": "300 Fake Signups a Day, and the CAPTCHA Was Losing",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/300-fake-signups-a-day-and-the-captcha-was-losing-5d6d3d8a4802",
      "summary": "Bots do not solve CAPTCHAs anymore, people do. What it takes to defend a signup flow when the attacker's economics beat yours."
    },
    {
      "name": "Post-Quantum Keys Don't Need OpenSSL",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/post-quantum-keys-dont-need-openssl-54077ef35688",
      "summary": "Why save a quantum-proof key through the biggest classical crypto library? A small C codec that cuts the cord, and how little ASN.1 you actually need."
    },
    {
      "name": "How I Parse Domain Names For a Certificate Authority",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/how-i-parse-domain-names-for-a-certificate-authority-92a940f32bea",
      "summary": "The surprisingly deep rules behind validating a domain name: RFC label limits, IDN/punycode, the Public Suffix List, and the edge cases that break naive checks. Companion to the domain_sanity gem."
    },
    {
      "name": "We Reset the Password. We Reset 2FA. The Attacker Came Back in Seconds.",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/we-reset-the-password-we-reset-2fa-the-attacker-came-back-in-seconds-17575ad55246",
      "summary": "A session hijacking war story: an attacker who survived password resets, 2FA resets, and full endpoint forensics, and the application-layer defense that finally ended it."
    },
    {
      "name": "A Secret You Cannot See Is Safer: Building a Secure Memory Buffer in C",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/a-secret-you-cannot-see-is-safer-building-a-secure-memory-buffer-in-c-876839dd6a66",
      "summary": "Where a private key really lives while you use it, and a small C library (libpqcsb) that keeps it off swap, out of core dumps, and behind guard pages. What each protection actually buys you."
    },
    {
      "name": "Trust, but Instrument: The Insider Threat Playbook",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/trust-but-instrument-the-insider-threat-playbook-c134742b7de0",
      "summary": "News-anchored playbook (Apple/OpenAI, Rippling v. Deel, Coinbase) for catching insider threats: log reads not just writes, baseline behavior, plant canaries, and gate privileged access."
    },
    {
      "name": "How to Stop SMS Pump Fraud From Draining Your Wallet (and Sanity)",
      "publisher": "Medium",
      "url": "https://medium.com/@msuliq/how-to-stop-sms-pump-fraud-from-draining-your-wallet-and-sanity-11ea5435608d",
      "summary": "Practical playbook for detecting and shutting down SMS pumping attacks, drawn from production experience defending a global PKI vendor."
    },
    {
      "name": "Authenticating with OmniAuth and OpenID Connect (OIDC) in Rails",
      "publisher": "Medium",
      "url": "https://msuliq.medium.com/authenticating-with-omniauth-and-openid-connect-oidc-in-ruby-on-rails-applications-e136ec5b48c0",
      "summary": "Step-by-step guide to wiring OIDC authentication into a Ruby on Rails application using the omniauth_oidc gem."
    }
  ],
  "services": [{"title":"Support tooling for Intercom teams","body":"Conversations tagged and routed on arrival, account and billing context pulled into the inbox so agents stop switching tabs, escalations posted to the right Slack channel, and SLA risks flagged before they turn into churn."},{"title":"In-house AI models","body":"AI that runs on your own servers, so customer data never goes to a third-party AI provider. That matters for security, for your customers' privacy, and for rules like GDPR, HIPAA, and the data residency terms in your contracts. I fine-tune lightweight open-source models into experts on your subject, connect them to your internal tools, and debug them when the answers go wrong."},{"title":"Integrations and two-way syncs","body":"Intercom, Salesforce, Stripe, Slack, your own app, or any REST API. Verified webhooks, retries, and idempotent handlers, so a record is never written twice and a failed call never disappears silently."},{"title":"Authentication and login security","body":"Single sign-on over SAML and OpenID Connect with Entra ID, Cloudflare Access, or any identity provider. OAuth sign-in, passkeys, two-factor authentication, and bot protection with reCAPTCHA and Cloudflare Turnstile that stops fake signups without punishing real users."},{"title":"APIs, clients and servers","body":"REST APIs for your product with API keys, scopes, rate limits, and OpenAPI docs. OAuth provider or client, depending on which side of the connection you are. Clients for third-party APIs that handle pagination, retries, and token refresh."},{"title":"Internal tools that replace spreadsheets","body":"Admin panels, ops consoles, and approval flows with roles and an audit log. The spreadsheet three people edit at once becomes a tool with one source of truth."},{"title":"Dashboards and reporting","body":"The numbers someone assembles by hand every Monday, live on one screen, plus scheduled digests to Slack or email."},{"title":"Security built in, not bolted on","body":"My background is security engineering. Least-privilege API scopes, secrets kept out of code, signed webhooks, and audit trails come standard, because your tools touch customer data."}],
  "caseStudies": [{"title":"Subject-expert AI on modest hardware","context":"In-house AI, self-hosted","body":"Lightweight open-source models fine-tuned into experts in one specific field, so they run in house on modest hardware instead of an expensive general model. Tuned the output language so answers read naturally to customers and improve their experience.","stack":["PyTorch","Hugging Face","LoRA","vLLM","llama.cpp"]},{"title":"Company-wide authentication platform","context":"Top-10 global certificate authority","body":"Sole architect of login and identity for tens of thousands of daily users: OAuth2, OpenID Connect, SAML, external identity providers, and the OAuth provider side, not only the client. Extracted authentication into its own service with sessions that work across services, and closed account-takeover and second-factor-bypass paths.","stack":["Rails","OAuth2","OIDC","SAML","PostgreSQL"]},{"title":"Bot protection at 1,000+ fake signups a day","context":"Top-10 global certificate authority","body":"Layered signup defense with reCAPTCHA v2/v3 and Cloudflare Turnstile, plus countermeasures for human CAPTCHA farms that solve challenges by hand. Fake accounts stopped without adding friction for real customers.","stack":["Rails","reCAPTCHA","Turnstile","Redis"]},{"title":"Stripe billing that cannot double-apply","context":"SaaS product, Ruby on Rails","body":"Full subscription lifecycle - checkout, upgrades, cancellations, refunds, failed payments, trial reminders, and disputes - driven by eight Stripe webhook events. Every event is recorded before it is processed, so Stripe's retries never charge, refund, or downgrade anyone twice.","stack":["Rails","Stripe","PostgreSQL"]},{"title":"An MCP server and Claude plugin for a live product","context":"SaaS product, Ruby on Rails + Python","body":"Seventeen tools that let Claude work inside a user's own account, behind OAuth with PKCE, dynamic client registration, a mandatory consent screen, and the same read/write/admin scopes as the REST API. Shipped as a published Claude Code plugin with slash commands, skills, and an eval suite run before each release.","stack":["Rails","OAuth 2.1","MCP","Python"]},{"title":"One business layer, three surfaces","context":"Standalone service, Go","body":"A Go service where the web UI, the MCP endpoint, and a JSON API all run through one tool registry, so they cannot drift apart. Callers subscribe to state changes through HMAC-signed webhook callbacks, and every state change is written to an event log in the same transaction.","stack":["Go","htmx","SQLite","MCP"]},{"title":"Team alerts where people already work","context":"SaaS product, Ruby on Rails","body":"Per-team notifications over Slack, email, and custom webhooks. Destination URLs are resolved and checked before use, so a customer-supplied webhook cannot be pointed at internal infrastructure.","stack":["Rails","Slack","Webhooks"]},{"title":"Admin console and email pipeline","context":"SaaS product, Ruby on Rails + Hotwire","body":"Internal console for users, teams, subscriptions, capacity, and monitoring stats. Moved the newsletter off a third-party email platform onto Amazon SES, with bounce and complaint handling over verified SNS notifications.","stack":["Rails","Hotwire","Amazon SES","SNS"]},{"title":"Staff tooling for fraud and abuse response","context":"Top-10 global certificate authority","body":"Internal detection and review tooling that pairs LLM-assisted pattern matching with human-led forensics, taking the team from first signal to mitigation in minutes instead of days. Also covered staff and admin activity, not only customer accounts.","stack":["Rails","PostgreSQL","LLMs"]}],
  "advisory": {"areas":[{"title":"In-house AI models","body":"Running AI on your own infrastructure instead of sending data to an outside provider, for security, privacy, and compliance. Choosing the model, fine-tuning it, debugging it, and connecting it to your systems."},{"title":"APIs and integrations","body":"How your systems should talk to each other: API design, connecting tools like Stripe, Salesforce, Intercom, and Slack, and webhooks that never lose data."},{"title":"Security and fraud","body":"A review of your login, account recovery, and payment flows, and a plan to stop fake signups, account takeover, and abuse."},{"title":"Authentication and identity","body":"Choosing and rolling out SSO, OAuth, passkeys, and 2FA without locking out your real users."},{"title":"PKI and certificates","body":"Certificate lifecycle, automation, and what new browser and industry rules mean for your systems."},{"title":"Performance and scale","body":"Finding out why the app is slow, what to fix first, and what will break at the next 10x."}],"formats":[{"title":"One-off review","body":"A written report with what I found, why it matters, and what to do next."},{"title":"Monthly advisory","body":"Regular calls with your team, plus questions by email or Slack between calls."},{"title":"Hands-on help","body":"I work with your engineers on the fix, not only on the report."}]},
  "files": [
    {
      "name": "General resume",
      "type": "application/pdf",
      "url": "https://msuliq.github.io/resumes/resume_suleyman_musayev.pdf"
    },
    {
      "name": "Security and fraud resume",
      "type": "application/pdf",
      "url": "https://msuliq.github.io/resumes/resume_suleyman_musayev_security.pdf"
    },
    {
      "name": "Product engineering resume",
      "type": "application/pdf",
      "url": "https://msuliq.github.io/resumes/resume_suleyman_musayev_product.pdf"
    },
    {
      "name": "Early-stage teams resume",
      "type": "application/pdf",
      "url": "https://msuliq.github.io/resumes/resume_suleyman_musayev_startup.pdf"
    },
    {
      "name": "Distributed systems and scale resume",
      "type": "application/pdf",
      "url": "https://msuliq.github.io/resumes/resume_suleyman_musayev_bigtech.pdf"
    }
  ],
  "meta": {
    "canonical": "https://msuliq.github.io/profile.json",
    "lastModified": "2026-10-31T19:01:28+00:00"
  }
}