Portfolio_
Professional headshot of Muhammad Asyraf Marzuki
> SYSTEM ONLINE // HI, MY NAME IS_

Muhammad Asyraf Marzuki.

[ Principal Systems Architect // Autonomous Agentic Systems • Distributed Backends ]

Principal systems architect and full-stack engineer with 9+ years of experience modernising high-scale enterprise Java/Spring systems and architecting multi-agent AI ecosystems. Outside enterprise production, I design resilient systems where distributed backend logic, edge security, autonomous agent orchestration, and embedded hardware meet.

Now// Tech Refresh & Modernisation @ Bestinet
Check out my workDownload Resume
// 01

About Me

I'm a full-stack engineer who works across layers. Professionally that means enterprise Java and Spring: at Bestinet I was handpicked for a Technology Refresh programme moving national-scale government systems onto Java, Spring Boot and Thymeleaf, where they have to stay reliable 24/7.

Independently, I've spent more than a decade experimenting in areas that looked unrelated at first: security, real-time messaging, games, mobile, embedded hardware and computer vision. Over time those threads started connecting, and today I'm comfortable moving between application code, backend architecture, databases, infrastructure, security, embedded systems, AI and games.

The problems I enjoy most are the ones where several of those layers have to work together. I don't claim depth in every tool; I learn whichever layer the system needs, then build it properly.

// profile.sysOnline
Role
Principal Systems Architect / Lead Engineer
Focus
Enterprise Modernisation & Agentic Systems
Based
Kuala Lumpur, Malaysia
Experience
9+ years professional, since 2017
Core stack
Java · Spring Boot · Next.js · Supabase · Node.js · C#
Range
Distributed Systems · Multi-Agent Orchestration · Edge Security · Infra
Status
Open to new opportunities

What I bring

  • 01

    Legacy modernisation

    Moving national-scale government systems onto a modern Java and Spring Boot architecture while extending their core features.

  • 02

    Production reliability

    Owning critical incidents, tuning Tomcat and JBoss, and writing schedulers for time-critical, high-concurrency jobs.

  • 03

    Data across paradigms

    MongoDB, MySQL, PostgreSQL and Redis, chosen for the workload and optimised in production.

  • 04

    Systems thinking

    Treating application code, data, infrastructure and hardware as one system, so a fix in one layer doesn't quietly move the problem into another.

// 02

Work Experience

  1. Bestinet Sdn Bhd

    ActiveCyberjaya

    Java Full-stack Developer · Tech Refresh & Modernisation Specialist

    Mar 2023 – Present
    • Handpicked for a mission-critical Technology Refresh programme, modernising legacy government infrastructure with Java and Spring Boot.
    • Key contributor to the new architecture, bringing national-scale systems up to modern standards while extending core features.
    • Manage data persistence and optimisation across MongoDB and MySQL.
    • Configure and tune Apache Tomcat and JBoss for stable deployments, and build Java schedulers for time-critical, high-concurrency production jobs.
    • Own critical production incidents and act as a technical reference: unblocking other developers and contributing to architecture decisions.
    JavaSpring BootThymeleafMongoDBMySQLApache TomcatJBossActiveMQGitLabRedmine

  2. Self-employed

    ActiveKuala Lumpur

    Independent Systems Architecture & Technical R&D

    Jan 2018 – Present
    • Architected a 4-station heterogeneous multi-agent swarm (Scout, Architect, Parity, Security Sentinel) utilizing Model Context Protocol (MCP) and localized CUDA inference, cutting token burn by 80%+ with zero context degradation.
    • Built zero-trust database architectures leveraging PostgreSQL Row-Level Security (RLS), security-definer RPCs, and automated preflight risk gating for dual-client (Next.js & React Native) parity.
    • Designed and deployed Shikataganai Modern: an in-memory browser steganography vault with WebAssembly and zero persistence, running at the edge on Cloudflare Workers.
    • Building BagHodler: a real-time crypto portfolio simulator with deterministic tick logic, simulated slippage, and an ASCII-inspired terminal interface.
    • Prototyped custom hardware & edge systems: an ESP32-S3 desktop dashboard with LVGL, an autonomous indoor gas-leak monitor, and a dual-screen portable CyberDeck running Linux.
    Multi-Agent AI (MCP)Next.jsReact Native ExpoSupabase RLSPostgreSQLCloudflare WorkersCUDA / GGUFDockerESP32-S3

  3. AMK Technology Sdn Bhd

    Kuala Lumpur

    Full-stack Developer

    Feb 2022 – Aug 2022 · 7 mosClient // Touch 'n Go
    • Developed and maintained the client's web application on Java, Spring, the CUBA Platform and MySQL.
    • Contributed to development decision meetings and to shared learning within the team.

    Lead Angular Frontend Developer

    Sep 2021 – Dec 2021 · 4 mosClient // Sapura Transmission (on-site)
    • Led a team of frontend and backend developers building and maintaining an administration web application.
    • Assigned and managed the team's work and gave technical guidance.

    Angular Frontend Developer

    Mar 2021 – Aug 2021 · 6 mosClient // Sapura Transmission (on-site)
    • Developed and maintained the administration web application with Angular CLI, Bootstrap and Node.js.
    JavaSpringCUBA PlatformMySQLAngularBootstrapNode.jsScrumKanban

  4. Implico (M) Sdn. Bhd.

    Kuala Lumpur

    C#.NET OpenTAS Developer (Backend + Frontend)

    Jan 2020 – May 2020 · 5 mos
    • Developed, maintained and fixed OpenTAS, a .NET system that manages downstream Oil & Gas operations, across its client application and framework.
    • Built backend services with REST, MVC and Microsoft Orleans (distributed virtual actor model).
    C#.NET FrameworkMicrosoft OrleansRESTMVC

  5. Agmo Studio Sdn Bhd

    Kuala Lumpur

    C#.NET Software Developer (Backend + Frontend)

    Aug 2019 – Dec 2019 · 5 mos
    • Supported and extended admin portals for a property developer, a pharmaceutical company and an oil & gas firm, covering UI, APIs and bug fixes.
    • Worked with ASP.NET MVC, Entity Framework (code-first and database-first), AngularJS, jQuery and Capillary CRM.
    ASP.NET MVCEntity FrameworkAngularJSjQueryTeam Foundation Server

  6. Delyva

    Kuala Lumpur

    Node.js Software Developer (Backend)

    Sep 2018 – Jul 2019 · 11 mos
    • Built SaaS backend APIs on a Cote.js microservice architecture, and saw first-hand how it solves scaling problems.
    • Worked with Node.js, Express, MongoDB, PostgreSQL and Redis, plus Laravel on the PHP front end, in Scrum with Kanban tracking.
    Node.jsExpress.jsMongoDBPostgreSQLRedisCote.jsLaravelGitLabJira

  7. Freelance

    Kuala Lumpur

    Web & Software Developer

    Jan 2017 – Aug 2018 · 1 yr 8 mos
    • Built an e-commerce web app (PHP, JavaScript, MySQL) and an integrated student attendance, registration and monitoring system (C#.NET, MySQL).
    • Built an Android budget-management app in Java and an electronic billboard system.
    • Protected user data on registration and login pages with RSA encryption.
    • Prototyped a game in Unity3D with C#.
    PHPJavaScriptMySQLC#.NETJavaAndroidUnity3D
// 03

Featured Projects

Simulated previewSecurity · WebAssembly · Cryptography
JOB_01 · 2026

Shikataganai Modern

High-performance client-side steganography vault and interactive bitwise visualizer, modernising a 2014 diploma FYP. Encodes encrypted payloads into carrier image pixels using an AssemblyScript/WASM engine with zero server leakage. Features real-time HyperFrames reactive animations and an in-memory buffer pipeline for instant encode/decode roundtrips.

Next.js 15WebAssemblyAssemblyScriptTypeScriptHyperFramesCloudflare WorkersTailwind CSS
Live DemoSource
Simulated previewSystems Architecture · Multi-Agent AI · Zero-Trust SecurityIn progress
JOB_02 · 2026

Project-LHp

A high-concurrency multi-role marketplace engineered through a 4-station autonomous agent pipeline with strict preflight governance. Zero-trust authorization is enforced directly in PostgreSQL via Row-Level Security (RLS), security-definer RPCs, and guard triggers. Features 87 automated boundary tests and complete Web (Next.js 16) and Mobile (React Native Expo) feature parity.

Next.jsReact Native ExpoSupabase RLSPostgreSQLAgentic Orchestration (MCP)Cloudflare
Simulated previewGame systems · Simulation
JOB_03 · 2026

BagHodler

A market-cycle trading game you arrive late to. Every market is a pure function of its seed, so the Daily run is identical for everyone, and leaderboard scores are verified by replaying the run instead of trusting the client. Ships as a single HTML file, an Electron desktop build with Steam integration and a web demo, guarded by more than 30 test suites for determinism, balance and UI.

JavaScriptCanvasElectronSteamworksSupabase Edge FunctionsPlaywright
Hardware × softwareEmbedded × AI × Infra

// Signal path

  1. ESP32-S3 · LVGL
  2. WebSocket
  3. Node gateway
  4. Ollama + search
JOB_04 · 2026

Portable CyberDeck V2

A handheld ESP32-S3 deck with an 800×480 touchscreen UI built in LVGL: dashboard, system status, a shell feed and an animated companion that reacts to build and server events. It talks to a self-hosted Node gateway in front of Ollama for AI chat and web search; the gateway installs itself on Linux or Windows and updates itself from Git.

C++ESP32-S3LVGLWebSocketNode.jsOllama
Simulated previewData · AI · Real-time
JOB_05 · 2026

Sentiment Radar

A live market-sentiment dashboard. A Node backend polls news feeds, tags headlines to tracked assets, scores them with Claude (falling back to a keyword heuristic without an API key) and streams updates to the browser over Server-Sent Events. Adds SMA/RSI/MFI technical reads and a backtest that checks whether sentiment actually leads price.

Node.jsExpressServer-Sent EventsClaude APITechnical Analysis
Simulated previewInfra · Security
JOB_06 · 2023

Ghostbyte Gateway

The Go gateway that fronted ghostbyte.xyz: a TLS reverse proxy routing to Go and Python services (OCR, steganography, NFT data, a WhatsApp bot), with per-route rate limiting, a concurrency guard, Google OAuth2 sign-in and IP geolocation. Containerised with Docker.

Gogorilla/muxOAuth2Rate LimitingDockerCloudflare
Simulated previewWeb3 · Frontend
JOB_07 · 2023

Tatsumeeko NFT Explorer

An Angular app for exploring a Solana NFT collection: floor price, recent sales, active listings, individual NFTs and owner wallets, using Magic Eden marketplace data served through the Ghostbyte gateway.

AngularTypeScriptRxJSSolanaMagic Eden API
Simulated previewComputer vision
JOB_08 · 2023

Web OCR

Paste an image URL and get the text back. A React front end calls a Go API, which runs a Python EasyOCR pipeline and returns the image annotated by OpenCV with every confident text region boxed and labelled.

ReactGoPythonEasyOCRPyTorchOpenCV
Simulated previewEmbedded
JOB_09 · 2018

Raspberry Pi Gas Alarm

A gas-leak alarm written in C. It samples a gas sensor through an SPI ADC every second, shows the reading on an I2C LCD, logs it to MySQL, and on a leak sounds a buzzer and sends an SMS through a GSM module over UART.

CRaspberry PiwiringPiSPI / I2C / UARTMySQL
Source
Simulated previewDesktop · Markets
JOB_10 · 2018

Early Crypto Tools

Desktop market monitors from 2018 for watching prices without a browser open: CryptopiaPriceWatch polls the Cryptopia API every second, and a Poloniex monitor built on the open-source PoloniexApi.Net library.

C#.NETWinFormsWPFREST APIs
CryptopiaPoloniex
Simulated previewSecurity
JOB_11 · 2018

Browser Defender

Prototype Chrome and Firefox extensions that watch for script payloads injected through the URL, stop the page from rendering and warn the user that it may be a cross-site scripting (XSS) attack.

JavaScriptBrowser ExtensionsWeb Security
FirefoxChrome
Simulated previewDesktop · Reliability
JOB_12 · 2018

App Restarter

A Windows watchdog that keeps an eye on a target application and relaunches it automatically when it crashes or exits.

C#.NETWinForms
Source
// 04

Engineering Archive

Archive_scan_complete · 6 eras · 33 entries · 2014 → 2025–26

How the work got here: a decade of experiments across unrelated-looking areas that gradually converged into larger systems.

  1. 2014Exploration

    Foundations

    Experiments with no single direction yet: hiding data inside images, recognising speech, manipulating pixels, and getting two programs to talk over a socket.

    • Steganography
    • Speech recognition
    • Bitmap / pixel manipulation
    • Chat client & server
    • Truth-table analysis
    • POS systems
    • Desktop utilities
    Open log · 6 entries
    $ ls experiments/2014/
    • steganography/ · hiding text in image pixels
    • speech-recognition/ · voice input experiments
    • image-processing/ · bitmap to pixel-array conversion
    • chat-systems/ · socket client & server
    • logic-tools/ · truth-table analysis
    • business-apps/ · point-of-sale prototypes
    6 entries
  2. 2015–16Exploration

    Games, Systems & Android

    Curiosity moved into game engines and phones: Unity prototypes, Android apps, camera APIs and more client/server tinkering.

    • Unity
    • Game prototypes
    • Android
    • Camera APIs
    • Client/server
    Open log · 4 entries
    $ ls experiments/2015-2016/
    • unity-prototypes/ · small game prototypes
    • android/ · first mobile apps
    • camera/ · camera API experiments
    • client-server/ · networking tests
    4 entries
  3. 2017–18Specialisation

    Mobile, Security & Hardware

    Projects started to have a point of view: protecting files in transit, locking devices, spotting attacks in the browser, and wiring software to physical sensors.

    • Android apps
    • Secure file transfer
    • Pattern locks
    • AES experiments
    • Browser security
    • Firebase
    • NFC / HCE
    • Voice translation
    • Raspberry Pi
    Open log · 7 entries
    $ ls experiments/2017-2018/
    • secure-transfer/ · encrypted file transfer
    • device-locks/ · Android pattern lock
    • realtime-chat/ · messaging on Firebase
    • nfc-hce/ · host card emulation
    • voice-translation/ · speech-to-translation app
    • browser-security/ · Browser Defender extensions
    • raspberry-pi/ · gas alarm with SMS alerts
    7 entries
  4. 2018–20Professional engineering

    Backend & Distributed Systems

    The first full-time roles pulled the focus server-side: Node.js microservices at Delyva, then C# and .NET enterprise portals and a distributed actor-model system. Crypto market monitors kept the side projects going.

    • Node.js
    • REST APIs
    • Microservices
    • Redis
    • PostgreSQL
    • MongoDB
    • C# / .NET
    • Electron
    • Socket.IO
    Open log · 6 entries
    $ cat worklog/2018-2020.log
    • Delyva · Node.js microservices on Cote.js
    • Agmo Studio · ASP.NET MVC admin portals
    • Implico · OpenTAS on Microsoft Orleans
    • market-monitors/ · Cryptopia & Poloniex desktop tools
    • node-experiments/ · Node.js & Socket.IO
    • ghostbyte/ · backend experiments
    6 entries
  5. 2021–24Professional engineering

    Enterprise Engineering

    Professional work matured: leading an Angular frontend team, Java and Spring for a payments client, then Bestinet's Technology Refresh of national-scale government systems, with production support, server tuning and database optimisation. Side projects moved to Go, computer vision and Web3.

    • Angular
    • Frontend leadership
    • Java / Spring
    • Enterprise architecture
    • Production support
    • Tomcat / JBoss
    • Technology refresh
    • Database optimisation
    Open log · 6 entries
    $ cat worklog/2021-2024.log
    • AMK Technology · Angular frontend lead, Sapura Transmission
    • AMK Technology · Java / Spring / CUBA, Touch 'n Go
    • Bestinet · Technology Refresh on Java / Spring Boot
    • ghostbyte-gateway · Go reverse proxy
    • web-ocr · Go + Python + EasyOCR
    • tatsumeeko · Angular NFT explorer
    6 entries
  6. 2025–26System integration

    Integration Phase

    Separate interests started meeting inside the same systems: embedded hardware talking to self-hosted AI, a game with a replay-verified backend, and a platform whose security boundary lives in the database.

    • Local LLM infrastructure
    • AI-assisted development
    • ESP32 systems
    • Game development
    • SaaS architecture
    • Security-focused data architecture
    Open log · 4 entries
    $ ls systems/active/
    • project-lhp · database-enforced authorization
    • baghodler · deterministic markets, Electron + Steam
    • cyberdeck-v2 · ESP32-S3 + Node gateway + Ollama
    • sentiment-radar · news scoring over SSE
    4 entries

Early years are grouped by topic, and dates are approximate.

// Recurring patterns

Threads that kept coming back, sometimes years apart. They show recurring interests, not one codebase growing into another.

  • Security

    2014 → 2018 → 2023 → 2026

    1. 2014Steganography experiments
    2. 2018Browser Defender
    3. 2023LSB steganography Worker
    4. 2026Database security boundaries

    Recurring question: where should protection actually live?

  • Real-time systems

    2014 → 2018 → 2026

    1. 2014Chat client & server
    2. 2018Node.js microservices
    3. 2026WebSocket & SSE streams

    Interest resurfaced in event-driven backends and live dashboards.

  • Human ↔ machine

    2014 → 2017 → 2026

    1. 2014Speech recognition
    2. 2017Voice translation app
    3. 2026CyberDeck + self-hosted LLM

    Concept returned through a handheld device with an AI companion.

  • Game systems

    2015 → 2018 → 2026

    1. 2015Unity prototypes
    2. 2018Unity3D freelance prototype
    3. 2026BagHodler

    Later revisited with deterministic simulation and replay verification.

  • Market software

    2018 → 2023 → 2026

    1. 2018Crypto price monitors
    2. 2023NFT collection explorer
    3. 2026Sentiment Radar

    Recurring theme: turning noisy market data into something readable.

  • Computer vision

    2014 → 2016 → 2023

    1. 2014Bitmap → pixel arrays
    2. 2016Camera API tests
    3. 2023OCR & YOLOv5

    Interest resurfaced once GPU-backed models made it practical.

// 05

Skills

Grouped by what they are used for. Depth varies: the enterprise Java and backend work is daily practice, while some embedded and AI tools come from independent projects.

  • 01Languages

    • Java
    • TypeScript / JavaScript
    • C#
    • Go
    • Python
    • C / C++

  • 02Backend & Distributed

    • Spring Boot
    • Node.js / Express
    • REST APIs
    • WebSocket
    • Server-Sent Events
    • Microservices
    • Schedulers
    • ActiveMQ
    • Microsoft Orleans

  • 03Data

    • PostgreSQL
    • MySQL
    • MongoDB
    • Redis
    • Supabase
    • Row-level security

  • 04Frontend

    • Angular
    • React
    • Next.js
    • React Native
    • Thymeleaf
    • Tailwind CSS

  • 05Infrastructure

    • Linux
    • Docker
    • Nginx
    • Reverse proxies
    • TLS
    • Cloudflare
    • Vercel
    • AWS Lambda
    • CI/CD

  • 06Embedded

    • ESP32-S3
    • Raspberry Pi
    • LVGL
    • UART / SPI / I2C
    • WebSocket clients

  • 07AI & Agentic Systems

    • Multi-Agent Orchestration (MCP)
    • Asymmetric Tier Routing
    • Context Compression & Gating
    • Local CUDA / GGUF Offload
    • Ollama / LM Studio
    • Computer Vision (OpenCV, YOLO)

  • 08Games & Desktop

    • Unity
    • Deterministic simulation
    • Electron
    • Steamworks
    • WinForms / WPF

  • 09Engineering

    • System architecture
    • Legacy modernisation
    • Production debugging
    • Performance tuning
    • Security boundaries
    • API design
    • Technical leadership
// 06

Education

UniKL MIIT

Diploma in Information Technology
Computer Science
GPA: 3.24
Jan 2012 - Dec 2014

UiTM Sri Iskandar

Diploma in Science Computer
Sep 2009 - Dec 2011

Taiping Technical School

Mechanical Engineering
Jan 2007 - Dec 2008
// 07

Interests

Away from the day job I'm usually on the move, in a café with a side project open, or pulling ideas from one field into another.

  • Travelling

    Exploring new places and the people in them.

  • Weekly workouts

    Training every week to keep body and focus sharp.

  • Motorcycle rides

    Clearing my head on two wheels.

  • Café sessions

    Finding a good café and building my own projects.

  • Video games

    Playing them, and taking apart what makes them work.

  • Anime

    Especially sci-fi and fantasy worlds.

  • Music

    Always something playing while I work.

  • Unconventional concepts

    Tinkering with ideas most people would not try.

  • Bridging domains

    Combining hardware, games, finance and software into one thing.

// 08

Get In Touch

I’m currently looking for new opportunities, my inbox is always open. Whether you have a question or just want to say hi, I’ll try my best to get back to you!

Say Hello

// Elsewhere