Selected work

Here's a selection: current work, a couple of things I've built for myself, and a condensed look back over twenty-something years.

Now

Veracode — Identity & Zero-Trust

I lead the modernization of Veracode's identity platform, the authentication and authorization layer the rest of the product depends on. Recent and ongoing work:

• Zero-trust built on a creative use of OAuth specs: Token Exchange, Device Flow, Client Credentials, and DPoP device binding, combined with fine-grained authorization.
• A Spring Authorization Server foundation enabling SCIM 2.0 and custom OAuth flows.
• A flexible policy/rules engine for complex enterprise standards compliance.
• A customer-defined custom roles system and a self-service free-trial platform.
• Observability with Grafana and Datadog plus k6 load-testing infrastructure, so our teams can build, test, and ship with confidence.
• A Spring AI classification system that detects and filters spam trial signups.

Mostly Java and Spring Boot (including Spring Authorization Server) on the back end; React, Angular, and TypeScript on the front; Postgres, Redis, and Kubernetes underneath.

Things I've built for myself

detroit.games/euchre

My family started playing Euchre remotely during covid, and we still play whenever we travel or can't get together. The mobile app we used got so aggressive with ads, hidden buttons, forced app-store detours, and a full screen interstitials that booted you mid-game, that it turned a fun time into a stressful one. So I built card game engine myself, to own the UX end to end and make playing Euchre, and other card games, fun again.

This site

jimjonah.dev is a static Astro site — no server, no database, minimal JavaScript. The blog content is Markdown with a schema that mirrors the AT Protocol site.standard.document lexicon, so posts appear natively in Bluesky's timeline and in other AT Protocol standard.site-aware clients like Leaflet and Offprint.

Not live yet

An audio transcription application that runs locally on a Mac, where the transcription happens on the device. Yes, there are plenty of applications like this, but almost all use a cloud service for the transcription. The primary use case for this is journalists who do long interviews and need a way to quickly highlight parts of the transcription for exporting as quotes while keeping the full interview secure.

Before this

Twenty-something years of platforms and tooling across many domains:

• BMC Software — Java/ANTLR4 parsers and interpreters for COBOL, PL/I, Rexx, and JCL, plus graph-based visualization tools that turn mainframe logic into interactive flowcharts and program-to-program call graphs. I was awarded a patent for a unique twist on a COBOL code editor.
• Compuware — 17 years working on the Topaz visualization platform (Runtime Visualization, Program Analysis), the Vantage Analyzer high-throughput distributed APM tool, and the OptimalJ code modeling/generation tool.
• Organic / Chrysler — architected, built, and led Chrysler Group's web presence through its early years online, growing the interactive group to 90+ and migrating the platform from Pro*C/C++ CGI to Java J2EE.
• Ross Roy — built an interactive agency from a team of 3 to 60+ that was spun off and IPO'd during the dot-com era.