Shubham Mathur

Role

Lead Engineer — I led the architecture, backend engineering, vendor integration, and cross-platform technical strategy.

The Challenge

Vimeo faced potential fines up to 10% of global revenue if it failed to verify the age of 4.5M+ users under new UK/EU laws. The challenge was to implement strict assurance gates without storing sensitive personal data (toxic for GDPR), without breaking the user experience for our highest-value subscribers, and without fragmenting the experience across Web, Mobile, and TVOS.

The Approach

I spearheaded the end-to-end technical delivery, architecting a zero-trust solution where Sensitive Personal Information (SPI) is filtered at the vendor (Persona) edge, meaning we only ever store 'pass/fail' tokens. I designed the centralized 'Age Verification' middleware logic within our PHP monolith to dynamically enforce compliance gates based on region and capabilities. To solve for TVOS input constraints, I engineered a 'Device Handover' API generating QR codes for seamless mobile verification. I also collaborated with Payment Engineering to design 'exemption logic' that automatically bypasses verification for subscribers with verified credit cards, safeguarding retention.

Key Impact

• Shielded Vimeo from massive regulatory fines (UK Online Safety Act, EU DSA)
• Achieved 100% GDPR liability reduction via zero-trust SPI architecture
• Safeguarded retention for high-value subscribers via automated payment exemptions
• Authored the source-of-truth Tech Specs used by Web, Mobile, and TVOS teams
• Proactively identified and mitigated XSS and Open Redirect vulnerabilities in the auth flow

Role

Lead Architect — I owned the design, migration strategy, and core design decisions while guiding the team’s implementation.

The Challenge

Our critical authentication logic was buried inside a 15-year-old PHP monolith with zero documentation. The system was fragile, impossible to scale independently, and a nightmare for onboarding. We needed to break this out into a modern service without disrupting login for millions of active users.

The Approach

I led the ground-up architecture of 'Anumati,' a production-ready Identity Service in Golang selected for its concurrency primitives. I reverse-engineered code from 2008 to create the first-ever blueprint of our auth flow. To enable a safe migration, I engineered complex backward-compatibility middleware that replicates legacy cookie generation and hashing algorithms exactly, allowing us to employ a 'Strangler Pattern' rollout where the new service takes over incrementally.

Key Impact

• Authored the first definitive documentation for Vimeo's 15-year-old auth flow
• Architected a dual-protocol (HTTP & gRPC) service for future-proof communication
• Implemented structured logging and distributed tracing from Day 1
• Led code reviews and design decisions, mentoring the team on Go and microservices

Role

Technical Lead — I owned the technical spec, architectural consensus, and final delivery.

The Challenge

Vimeo's legacy deactivation system was non-deterministic and unscalable, creating severe legal (GDPR) and security risks. It choked on high-volume creators (1.6M+ clips), causing resource starvation as queues remained clogged for months. This led to a 'Zombie' state where 195,000+ users were flagged as deactivated but could still log in, violating data retention policies.

The Approach

I spearheaded the end-to-end architectural overhaul (Project 'Purgatory'). Key strategies included: 1. Domain-Driven Design (DDD): I established a Single Source of Truth for user status within the User object, eliminating table mismatch issues. 2. Queue Architecture: I replaced synchronous processing with an asynchronous queue system using MD5 payload matching, enabling bulk ingestion of 50,000+ items without timeouts. 3. Cron Optimization: I engineered a specialized scheduling algorithm that decoupled user deletion from clip deletion to maximize throughput.

Key Impact

• Eliminated the 'Zombie' user state, achieving 0% reported incidents post-launch
• Reduced average deactivation time by 99.9% (from 2 days to <5 minutes)
• Scaled processing capacity from <4k to >1.6 million clips per account without timeout
• Identified and reconciled 195,000+ inconsistent accounts to meet GDPR compliance

Role

Engineer 2 — Led the backend architecture and AI integration.

The Challenge

Enterprise banks needed an IVR that felt natural to talk to but didn't compromise on the incredibly strict data security rules of the financial industry.

The Approach

I researched and built secure integration layers for OpenAI with aggressive PII redaction pipelines. I used NestJS to manage the state of conversations so the bot could remember context, while preventing prompt injection attacks.

Key Impact

• Delivered secure GenAI for enterprise banking
• Achieved zero data leakage with PII redaction
• Enabled natural, multi-turn conversations
• Met strict banking compliance standards

Role

Full Stack Developer — Built the notification service and frontend features.

The Challenge

A major pharma company needed a reliable way to help elderly patients manage chronic conditions, ensuring they took the right meds at the right time.

The Approach

I built a full-stack platform using React and Material UI. For the backend, I used Azure Functions and Twilio to build a queue-based notification system that could reliably send SMS reminders.

Key Impact

• Handled HIPAA-compliant data securely
• Helped reduce hospital readmission rates by 34%
• Ensured reliable SMS delivery via Twilio
• Successfully adopted by patients across the US

Role

Full Stack Developer — Handled backend features, security, and search.

The Challenge

Consultants were wasting time manually searching for materials and talent every time they started a new engagement. They needed a central hub to get started fast.

The Approach

I built the backend using Express, GraphQL, and Postgres. I implemented Role-Based Access Control (ACLs), search, and deep linking. I also integrated Okta for secure login and Box APIs so they could easily access documents.

Key Impact

• Helped take the product from MVP to full adoption
• Seamlessly integrated Box, Okta, and AWS
• Secured data with proper ACLs
• Modernized the UI with the MDS Design system

Role

Backend Developer — I handled the SOAP-to-REST decomposition and feature development.

The Challenge

The bank's lending platform was stuck waiting on legacy government systems for credit reports. It was slow, used outdated SOAP protocols, and frustrated the relationship managers trying to close deals.

The Approach

I designed a microservices architecture to break down those SOAP integrations into clean REST-based services using Spring Boot and Angular. I also built a system to fetch, normalize, and cache credit data so it was always ready when needed.

Key Impact

• Served over 20M+ customers reliably
• Boosted Relationship Manager productivity by 60%
• Successfully modernized the legacy stack
• Transferred knowledge to the client team for long-term ownership

Role

Full Stack Developer — I built the platform and mentored our interns.

The Challenge

The client had a manual process for recommending insurance products, which was slow and prone to errors. They needed to automate this for over 30 different products.

The Approach

I built a recommendation engine using React, Spring Boot, and Node.js. I had to learn Spring Boot and Hibernate on the fly to meet the deadline. I deployed parts of it on AWS Lambda for better scalability.

Key Impact

• Improved operational efficiency by 90%
• Served 1.3M users effectively
• Automated recommendations for 30+ products
• Mentored 3 interns on the project

Role

Full Stack Developer — Developed features, managed Docker containers, and mentored the client team.

The Challenge

The telecom's existing app was outdated and slow. They needed a modern replacement that could handle millions of users without breaking a sweat.

The Approach

I built the new app using React and Node.js (Hapi). We used a microservices architecture with Docker to keep things modular. I also focused heavily on reliability, adding retry mechanisms and increasing test coverage.

Key Impact

• Served 10M+ users successfully
• Increased unit test coverage by 40%
• Improved API reliability with retry logic
• helped upskill the client's dev team

Role

Creator — I did the research, implementation, and testing.

The Challenge

I wanted to understand the math behind real-time collaboration tools like Google Docs, so I decided to build the core data structures (CRDTs) myself.

The Approach

I implemented multiple CRDT types in TypeScript, including Sets and Counters. To make sure they were actually conflict-free, I designed a three-layer testing strategy: unit tests, property-based tests, and randomized simulation tests.

Key Impact

• Built a library with 6+ robust data types
• Designed a thorough chaos testing strategy
• Verified correctness with deterministic simulations
• Published the package on npm