About
Shahil Kadia
I work at the seam where LLMs meet production software. Since August 2026 I have been the AI System Architect (consultant) at RegenAI, working remotely from Surat, India; before that I shipped AI features there as an AI Developer Intern from January 2025. The work spans agent write-integrity, prompt-injection defense, retrieval and embeddings infrastructure, GPU inference operations, and the unglamorous platform half: disaster recovery as code, a first production WAF enforcement flip, and monitoring cost cut by an order of magnitude with zero coverage loss.
The through-line is making LLMs safe to lean on. That has meant eliminating five verified remote-code-execution chains in AI-generated code, making agent-written arguments structurally unable to become production writes without a human, and proving zero regressions across a 41,043-test campaign. On the product side it has meant retrieval stacks for bilingual government document QA, four models co-served on a single GPU host, and a dictation app whose speech never leaves the machine.
Experience
AI System Architect (Consultant), RegenAI
2026/08 to present · Remote
Platform architecture for a multi-tenant AI-SEO SaaS on multi-region AWS: production security for AI-written code, disaster recovery, and cost work measured in ratios.
- Led the campaign that eliminated five verified remote-code-execution chains in AI-generated code with a stdlib-only, context-typed escaper applied at every sink, validated against a 541-payload matrix and a ported PHP parse oracle, then deployed to production.
- Made LLM-authored arguments structurally non-authoritative: stack-frame origin analysis strips auto-apply flags that arrive through agent dispatch and fails closed on anything it cannot walk, server identity is pinned, and a human converts suggestions into writes. Proven across a 41,043-test campaign with zero regressions.
- Centralized prompt-injection defense behind grammar-level invariants, closing marker-forgery classes across generation chains and cutting a 63-second regex denial of service to nine milliseconds.
- Designed a three-layer disaster-recovery architecture (Multi-AZ, cross-region replica, cross-region backups) with split-brain fencing on a pilot-light stack of 45 Terraform resources; the replica soaked 168 of 168 hours with zero breaches and a designed recovery time of 10 to 15 minutes.
- Executed the platform's first production WAF enforcement flip over 462,901 observed requests with a byte-exact rollback pre-built, then root-caused the roughly 470 post-flip blocked beacons to a count-mode logging blind spot and codified the fix as doctrine.
- Cut CloudWatch metric series about 94 percent with a structural growth cap, and retired billed alarm queries at roughly 72x lower running cost with zero coverage loss.
- Ended a forced-disconnect class that destroyed hour-long agent jobs with a custom gunicorn worker that drains connections instead of killing them.
AI Developer Intern, RegenAI
2025/01 to 2026/07 · Remote
Shipped AI features end to end for government clients in the Gulf and the company's own SaaS: retrieval, GPU serving, routing, and the outage fixes in between.
- Built the retrieval stack for a Gulf government client: pgvector hybrid search, semantic chunking, per-tenant sharded vector tables, and a cross-lingual Arabic-English re-query strategy for bilingual document QA.
- Ran vLLM FP8 mixture-of-experts serving at 92k-token context and co-served four models, from the flagship to Arabic-language and embedding models, on a single 8-GPU host with per-GPU assignment and lifecycle tooling.
- Built the bilingual benchmark program behind every inference decision: concurrency tiers to 80, tail-latency percentiles with bootstrap confidence intervals, and 10,000-request load tests.
- Wrote a 1,133-line custom GLM-4.5 provider for the agent framework and runtime routing across 11 model classes, including a hybrid thinking router whose bilingual complexity classifier decides per request when paid reasoning is worth running.
- Root-caused a recurring production WebSocket outage class (auth tokens in query strings tripping managed WAF rules) and moved authentication into the RFC 6455 subprotocol with a backend-first rollout, unblocking WAF block mode.
- Built the GitHub App pre-merge verification ladder so an AI-opened production pull request is, by construction, one that already built green: draft, verify, then promote or discard.
Education
B.Tech, Computer Science & Engineering
Amity University Mumbai · 2022 to 2026 ยท CGPA 9.20/10
- First Class with Distinction
- Early recognition: Smart India Hackathon state qualifier (blockchain, IPFS, encryption)
- GDSC CyberSecurity Lead, taught security fundamentals to 50+ students
Graduate, Cloud Developing, Cloud computing foundation, 40 hours
AWS Academy · 2024-12 to 2024-12
Tools I reach for
- Python
- TypeScript
- Rust
- SQL
- FastAPI
- PostgreSQL
- Redis
- AWS ECS Fargate
- Terraform
- GitHub Actions
- vLLM
- pgvector
- Langfuse
- Sentry
- Tauri
- Astro