Independent Technology Consultant
Durham, NC
Aug 2024 – Present
Ongoing contract engagement delivering the public website and authenticated staff platform for a development-stage nonprofit client operating under HIPAA obligations.
- Designed and built a layered platform separating the public WordPress site from an authenticated staff application, keeping regulated data off the public surface entirely
- Implemented the API tier on Cloud Functions with Firebase Auth, role-based custom claims, and enforced MFA for any role touching regulated data
- Separated storage by sensitivity: Cloud SQL PostgreSQL 15 on private IP with no public endpoint for PHI, Firestore under deny-all security rules for non-regulated operational data
- Scoped the environment so no live PHI is processed until a Google Cloud BAA is executed — compliant ahead of go-live rather than remediated afterward