John Suriaga

I’m a senior software engineer with 10+ years of production experience across healthcare, enterprise insurance, cloud security, consumer products, and applied AI, with consistent depth in compliance—HIPAA-regulated systems, SOX-adjacent audit infrastructure, GDPR-aligned data handling, and enterprise AI governance.

I specialize in making AI reliable in production, building LLM gateways and RAG pipelines with permission-aware retrieval, rate limiting, prompt-injection defenses, PII redaction, and structured enterprise audit logging.

I build and operate cloud platforms on AWS and GCP using Kubernetes and Terraform, and I focus on secure delivery by hardening services against adversarial inputs and standardizing security reporting through SAST findings normalization.

In my most recent role, I maintained an AI Gateway and improved access control by ~30%, delivered sub-200ms p95 retrieval latency with project-level ACL enforcement, and introduced CI-gated evaluation harnesses to prevent silent quality degradation. Earlier work includes backend platforms at Canva and compliance-focused audit-log and HIPAA verification patterns at eClinicalWorks.