About
Hi, I’m Moiz.
I’m a backend and infrastructure engineer finishing an A.B. in Computer Science at Dartmouth College — GPA 3.77, degree expected August 2026. Most of what I do sits below the interface: identity, background jobs, database invariants, the plumbing that nobody notices until it stops behaving.
The parts of a backend I actually enjoy are the ones that only show up under failure. A retry that fires twice because the first response was slow, not lost. Two browser tabs redeeming the same OAuth authorization code within a few milliseconds of each other. A rolling deploy that lands halfway through a request. Idempotency sounds like bookkeeping until you realize it’s the difference between a system you can restart and a system you have to apologize for.
I’m looking for new-grad backend and infrastructure roles starting August 2026 — distributed systems, PostgreSQL, reliability. If that’s the kind of work your team does, I would like to hear about it.
What I’ve been building
Since August 2025 I’ve been a software engineer at DALI Lab at Dartmouth, where I mostly get handed the problems that touch everything at once.
Evergreen — identity. I migrated the platform off Firebase Auth onto an OIDC/JWKS middleware that unifies SSO across Cognito in dev and staging and Dartmouth CAS in production, covering 20 internal services and 1,500+ study participants. It landed as a 58-file identity refactor, which is exactly as much fun as it sounds: every service had its own slightly wrong idea of what a subject claim was, and the point of the migration was to leave exactly one idea standing.
Evergreen — calendar sync. I shipped multi-account Google Calendar sync with per-account OAuth, a bounded concurrent fan-out so we don’t stampede the upstream API, careful separation of revoked credentials from transient failures, and cross-account event deduplication so the same meeting on two linked accounts shows up once.
Evergreen — push notifications. I owned delivery end to end across six merged PRs, with the goal of keeping reminders reliable through rolling deploys. That meant chunking FCM multicast at the SDK’s 500-token limit, scheduling reminders with SELECT FOR UPDATE SKIP LOCKED so two workers never claim the same reminder, and splitting permanent from transient errors so dead device rows get pruned instead of retried forever.
Link VT. Calendly OAuth sign-in was intermittently failing, and the cause was a duplicate authorization-code race — the same code redeemed twice. I fixed it with PKCE plus an idempotent server-side authorization-code cache, and separately isolated a form-versus-JSON mismatch in how we were talking to the upstream. I also shipped role-gated S3 ingestion for 120 coaches and 800 patients on a sub-5 GB pilot: MIME allowlists, size caps, sanitized object keys, cascading delete cleanup, and typed upload-progress UX so people can tell the difference between slow and broken.
Coursera × Dartmouth. I containerized a Cypress autograder for a Dartmouth–Coursera MOOC serving 800+ learners, with encrypted submissions, configurable spec filtering, React/Express/MongoDB lab templates, and a 16-test validation suite grading the grader.
Before that
I spent two summers at Muff Manufacturing, an industrial manufacturer in Manchester, UK — and they asked me back, which I choose to read as a good sign.
In summer 2025 I productionized an async image-generation pipeline: FastAPI handling uploads, Celery workers doing the expensive part on a single-GPU deployment, and S3 object-confirmation so a job is only “done” when the bytes are provably there. It averaged around 65 seconds per generation with a 60% approval rate on an 18-SKU pilot. I also replaced manual SSH-and-rsync deploys with a GitHub Actions deploy-on-merge workflow, and built a reviewer UI with side-by-side comparison and per-variant approve/reject persisted to PostgreSQL.
In summer 2024 I shipped FloorView, a FastAPI/React/PostgreSQL factory-floor dashboard with an append-only stage-transition audit log. It replaced spreadsheet and whiteboard tracking for 8 daily staff. Append-only logs are one of my favourite cheap wins: you stop arguing about what happened.
Things I’ve made on my own time
Digital Simple
FastAPI · Next.js · PostgreSQL RLS · arq + Redis · S3 · BagIt
A digital-preservation platform I build on my own time. Multi-tenant isolation is enforced at the database with PostgreSQL Row-Level Security policies, backed by a regression suite that fails loudly the moment a policy stops doing its job.
The interesting part is the job layer: arq and Redis workers treat PostgreSQL as the source of truth, with deterministic keys and lease-based worker ownership, so a worker dying mid-task is boring rather than catastrophic. On top of that sits a 7-state format-migration machine (TIFF to JP2, AVI to MKV) with pluggable adapters and validators, Siegfried format identification, and a PREMIS-aligned audit trail. 293 pytest tests keep me honest.
Moji-Proctor
TypeScript · Express · Prisma · PostgreSQL · GitHub OAuth Device Flow
A tamper-evident coursework integrity tool that lives inside VS Code. It keeps a cryptographically chained event log signed with Ed25519 device keys, with an explicit privacy boundary I refuse to blur: no source, no file contents, no diffs ever leave the editor.
Ingestion is replay-safe by construction — batched event endpoints, idempotent document IDs so reruns converge, JWT refresh rotation, pluggable persistence backends, and burst detection on configurable thresholds. Writing something that has to be trustworthy to both a professor and a student is a genuinely fun constraint.
Classmoji
TypeScript monorepo · open-source Dartmouth CS classroom tool
I contribute to an open-source classroom tool used in Dartmouth CS. In one sole-authored sweep (PR #99) I closed 13 security holes: GitHub webhook signature verification that computed HMAC over a re-serialized body, three IDOR endpoints, an SSRF, a stored XSS, and missing Stripe webhook idempotency.
I also led the TypeScript migration — roughly 92K lines across 987 files — which was promoted to the maintainers' staging branch, and shipped notifications plus a GitHub repo-analytics layer with scheduled refresh.
Teaching and school
I’m Lead TA for CS 52, Dartmouth’s full-stack web development course, and a TA for CS 59, Programming Languages. Between the two I’ve mentored 100+ students. Teaching full-stack is a useful mirror: you find out very quickly which things you understand and which things you have merely been getting away with.
Along the way I’ve picked up Faculty Citations in CS 52 (Full-Stack Web Development), CS 76 (Artificial Intelligence), and CS 98 (Senior Design and Implementation Project), plus Dean’s List for 2025–2026.
The tools I reach for
- Languages
- PythonTypeScriptJavaScriptJavaCC++SQL
- Backend & Infra
- FastAPINode.jsExpressREST APIsCeleryarqRedisDockerGitHub ActionsAWS (S3)Linux
- Data & Identity
- PostgreSQL (RLS)MongoDBAlembicPrismaOAuth 2.0 / OIDCJWT / JWKSPKCESSO (Cognito, CAS)
- Reliability & Testing
- IdempotencyRetriesDeduplicationLease locksAudit logsDistributed-systems patternspytestCypress
Say hello
If you’re hiring for backend or infrastructure work starting August 2026, or you just want to argue about lease locks and retry semantics, my inbox is open.