Abbas Tolgay Yılmaz

@UTC+3

aka. streamerd · Full Stack Engineer & Artist

atyilmaz.com · github.com/streamerd · linkedin.com/in/abbas-tolgay-yilmaz-0x0

Summary

Full stack engineer and hands-on CTO with 10+ years taking cloud-native platforms from design to production across banking, insurance, telecom, and energy, including four years in Germany. I like owning systems end to end: shipping clean, testable Go, the services that provision and run a fleet, and the release pipeline that builds, signs, and ships them as versioned artifacts and Linux packages, plus observability, graceful degradation, and rollback so reliability holds as usage grows. I care about efficiency and honest build-vs-buy calls, and I work closely with product, infra, and platform teams to turn real problems into features people use. Lately: security and AI products in Go, from identity and consent to post-quantum file security and runtime governance for AI agents.

Education

B.Sc. Computer Engineering

Izmir Institute of Technology · 2014

M.A. Information & Technology Law

İstanbul Bilgi University · 2016-2019 · left at thesis stage

Experience

Founder & CEO

Interposed

Remote - Buffalo, WY, USA · 2026 - Present

Governance and enforcement layer for AI coding agents, built in Go. A per-host Linux daemon and fleet operator put every agent action (exec, file, network) under policy, with zero data retention and a human in the loop for anything gray-area.

  • LSM-BPF kernel enforcer and policy broker that gate every non-trusted agent action over a watched process tree, with signed fleet-wide trust baselines and live policy reload.
  • Cooperative intent and MCP layer (declare_intent, query_policy, request_approval) so agents plan around policy instead of trial and error; trust footprints learned from per-session kernel audit.
  • Hardware-rooted multi-factor approval (FIDO2) with policy sealed on disk, Ed25519-signed audit to WORM storage and SIEM, and a desktop fleet operator managing many hosts over mutual Noise_IK.
  • Self-hosted Forgejo forge and runners over Noise; governed releases with isolated CI/CD sandboxes (cell) and minimal OS images; pipeline-integrated security: dependency and vulnerability scanning, supply-chain risk gating, and signed, auditable releases.
interposed.ai
Founding Engineer

invert-z

Remote - Helsinki, FI · Aug 2026 - Present

AI data foundry turning engineering and pipeline drawings into structured, risk-scored data. Building pilot applications for partners in the Nordics and North America.

  • Built inference pipelines and the eval harness for drawing-to-structured-data extraction and risk scoring.
  • Synthetic data generation and fine-tuning an open vision-language model (VLM) on our own labeled corpus; moving from rented frontier models to a self-hosted model with EU data residency.
invert-z.com
Staff Software Engineer

ConsAuth Systems

Remote - Buffalo, WY, USA · 2025 - Present

Consent-first identity platform: custom IdP with OAuth2/OIDC on Ory Hydra, Go services, PostgreSQL and Redis, SSO with user-owned preferences and Solid/WebID-aligned flows.

  • Owned protocol and service design around Hydra: authorization and token issuance, client and developer lifecycle, and consent and scope modelling for app-to-app permission flows at consumer scale.
  • Containerized and deployed the services, set up CI/CD and observability; owned both development and ops end to end.
consauth.com
Founding Engineer

Governate Oy

Remote - Helsinki, FI · 2025 - Present

Post-quantum file security platform built from scratch in Go on GCP: hybrid AES-256-GCM and Kyber-1024 encryption, policy-based access control, and cross-platform clients. Owned it end to end, from development to ops.

  • Go Fiber backend with mTLS, WebAuthn, MFA, and ClickHouse audit logging; real-time layer over NATS and Redis; Grafana and Prometheus observability; GitHub Actions CI/CD.
governate.com
Founder

Start a World Peace Teknoloji A.Ş.

Antalya, TR · 2023 - Present

Freelance engineering, open-source contributions, and building and experimenting with products.

stateful.art
Full Stack Software Engineer

Vattenfall Energy Trading GmbH

Hamburg, DE · 2019 - 2022

  • Built a Java-based, containerized data platform aggregating real-time feeds from 50+ wind turbines at Princess Alexia Wind Park, processing 5M+ telemetry events per day with Kafka and Cassandra.
  • Improved energy trading accuracy by 18% and reduced forecast deviation by 25% through turbine curtailing and production scheduling optimizations, increasing revenue from wind asset trading.
  • Engineered secure infrastructure for EV charging networks supporting 1,000+ active charging sessions per day.
  • Secured SCADA communications for power plants including CHP and nuclear facilities with the OpenMUC library, strengthening cybersecurity compliance.
Full Stack Software Engineer

Element Insurance AG

Lübeck, DE · 2018 - 2019

  • Scaled Java/Spring Boot insurance microservices serving 100K+ policyholders and delivered 5+ new platform capabilities by integrating APIs and shared services across teams.
  • Led cloud migration of 70% of workloads to AWS and introduced Terraform Infrastructure-as-Code, cutting environment setup time by 80%.
  • Built and optimized React dashboards used daily by 50+ internal users.
Full Stack Engineer, Consultant

Türkiye İş Bankası A.Ş.

Istanbul, TR · 2017 - 2018

  • Reverse-engineered and integrated legacy SOAP/WSDL services with SmartBear SoapUI's Java SDK to automate testing of core banking infrastructure.
  • Built internal web tools with a Spring Boot backend and jQuery and vanilla JS frontends, and standardized internal service contracts to speed onboarding for new engineers.
Software & System Integration Engineer

Ericsson

İzmir / Istanbul, TR · 2013 - 2017

Telecom. Started as an IT test intern at the Avea Test Hub in İzmir, then moved to Istanbul as an Ericsson consultant on Turkcell's Value-Added Services (VAS) and business operations. A progression from test engineering to system integration and software development, with deep telecom domain knowledge: cell-tower communications, SMS, IVR, and CDR (call detail records).

  • System Integration & IT Test Engineer (2014–2016): ran service integration and end-to-end testing across Turkcell VAS and business operations; contributed to UAT and SAT acceptance-test transformations on the Vodafone project.
  • Associate Software Engineer (2016–2017): contributed to internal tooling and integrations.
  • IT Test Engineer, Internship (2013–2014, İzmir): started with test environments and automation at the Avea Test Hub.

Skills

Languages

Go, Java, TypeScript, JavaScript, Swift, Python, Zig, Solidity, SQL, Shell

Backend & APIs

Go Fiber, REST, gRPC, WebSockets, SSE, GraphQL, SOAP/WSDL, Node.js, NestJS, Spring Boot, Express, React, Next.js

Cloud, Infrastructure & DevOps

AWS, Google Cloud (GCP), Terraform, OpenTofu, Docker, Kubernetes, Helm, Cilium, eBPF, Nginx, GitHub Actions, Forgejo (self-hosted Git + CI + registry), secure CI/CD, SBOM, secret and vulnerability scanning, static/dynamic code analysis, supply-chain security, artifact/package repositories, virtualization, Linux

Storage & Data

PostgreSQL, Redis, Elasticsearch, Cassandra, MongoDB, ClickHouse, ChromaDB

Messaging & Distributed Systems

Kafka, NATS, Redis Pub/Sub, Hazelcast, Traefik, microservices, event-driven architecture, high availability (HA)

Security, Identity & Cryptography

OAuth2, OIDC, Ory Hydra, IdP and SSO patterns, scopes and consent modelling, JWT, Passkeys, WebAuthn, FIDO2, ZK-Proofs, SNARK, Circom, Mutual TLS, X.509, Kyber KEM, least-privilege enforcement

AI & LLM Systems

LLM and VLM integration (Claude, Gemini, OpenAI), vision and document extraction via tool-use, prompt caching, RAG, embeddings and vector databases, agent harnesses and MCP tooling, AI agent runtime governance and enforcement

Observability & SaaS

Grafana, Prometheus, ClickHouse audit pipelines, Stripe, Paddle, subscription billing, SaaS product development

Standards & Protocols

W3C LDN, Solid Protocol, WebID, ActivityPub, AAuth, FIDO2

Ship Log

What I have built, shipped, and open-sourced. Products are live or in progress; open-source work is on GitHub.

visual art

Pastel and mixed-media works on paper.

have a look
music, synth

Synth loops and compositions, live-coded in Sonic Pi.

hey, listen
milsiz.art

Gallery platform for visual art and music.

milsiz.art
waitroom

Anonymized diaries of app approval wait times.

waitroom.dev
sociolog

Better visibility into Google Workspace OAuth.

sociolog.in
musicode

Code-based music synthesis and live coding.

github.com/streamerd/musicode
antipodal-navigator

Finds any location's antipode on Earth.

github.com/streamerd/antipodal-navigator
ghidra-mcp-zig

Ghidra reverse engineering over MCP, in Zig.

github.com/streamerd/ghidra-mcp-zig
fibergun

GunDB middleware for the Fiber framework.

github.com/streamerd/fibergun
auth-go

First Go implementation of the AAuth protocol.

github.com/aauth-dev/auth-go
fiber-webauthn

WebAuthn middleware for Fiber: passwordless FIDO2.

github.com/streamerd/fiber-webauthn
react-draggify

React window manager making any app draggable.

github.com/streamerd/react-draggify
seamlink

SEO-friendly link-tracking middleware for Fiber.

github.com/streamerd/seamlink
pip-anything

Any page element into Picture-in-Picture.

github.com/streamerd/pip-anything
youreco

Logs YouTube's post-video recommendations.

github.com/streamerd/youreco
somafm-cli-go

Terminal SomaFM radio player in Go.

github.com/streamerd/somafm-cli-go
paytr-go

Go SDK for the PayTR payment system.

github.com/streamerd/paytr-go
diplo-ai

Classifies diplomatic statements and drafts responses.

github.com/streamerd/diplo-ai