Skip to content

Elyas Syoufi

Senior Software Engineer · Tech Lead

I build systems that have to prove what they did.

Nine years inside a federal agency building production systems where every change has to survive audit: the system records who made it, and only certain roles are permitted to make it at all. I do that work on Agile teams, and I hold AI-assisted work to the same standard.

View all projectsEmail me
9
Years inside a federal agency
~44k
CRA users on the MAC platform
700+
AI assessments across 17 branches

Selected work

Six of eleven case studies, and the decisions that shaped them.

Governed Intake Systems

Canada Revenue Agency

Three production platforms inside a federal agency for deciding what is allowed to proceed: ethics review, algorithmic impact assessment, and innovation-fund intake. Each publishes its criteria before submission and ends at a named human signature.

  • 3 platforms
  • 700+ AI assessments
  • Flowable · BPMN · CMMN · DMN

AI Impact Assessment

Canada Revenue Agency

Intake and approval system for proposed AI projects, following the Government of Canada's Algorithmic Impact Assessment model. 87 questions across eight risk dimensions; a DMN decision table classifies the risk and BPMN routes the required approvals, ending at a named human signature.

  • 700+ assessments
  • 17 branches
  • DMN · BPMN

MAC

Canada Revenue Agency

Workflow platform on Flowable 6.6 running BPMN, CMMN and DMN engines in one Spring Boot deployment, with human task assignment bridged onto the agency's existing Kerberos identity.

  • ~44,000 users
  • 4 apps · 10+ workflows
  • BPMN · CMMN · DMN

ECSTP

Canada Revenue Agency

Replaced a Microsoft Access database with a Spring Boot and Angular platform for coordinating IT procurement between CRA and Shared Services Canada. Reference vocabularies are database rows, not enums, so the business changes its own terminology without a release.

  • 84 entities
  • 21 event subtypes

SIRMM Modernization

Canada Revenue Agency

Three generations of a federal security incident system, EJB/JSP to Spring Boot to Angular. Collapsed a 20-way JOINED hierarchy into shared-primary-key extension tables and ~120 near-identical options tables into two generic reference tables.

  • 308 → 61 tables
  • 7 domain services

TheraSite

Independent

Multi-tenant platform for Ontario psychotherapists under PHIPA. One database per tenant rather than a tenant_id column, because under that regime a cross-tenant query bug is a compliance violation rather than a bug. Messages are encrypted in the browser.

  • therasite.ca · live
  • Per-tenant databases
  • Browser-side decryption

Experience

Canada Revenue Agency · Ottawa, Ontario · May 2017 to present

  1. Senior Full-Stack Software Engineer, Tech Lead · IT Specialist (CS-03)Jan 2024 – present
  2. Full-Stack Software Engineer · IT Analyst (CS-02)Lead developer on SIRMM 2.0 from late 2022Jan 2018 – Dec 2023
  3. Software DeveloperMay 2017 – Dec 2017
Re-architected a legacy Java/EJB monolith into a Spring Boot and Angular platform serving a federal agency, preserving domain fidelity across a 308-table schema.
Escalation point for complex production defects: root-cause analysis from application logs and stack traces, then mentoring engineers through the diagnosis rather than taking the ticket over.
Designed the domain model for audit: Hibernate Envers revision history across 61 classes, with 31 explicit opt-outs covering derived links, file bytes, and denormalized keys.
Cut the Jenkins pipeline from 15 minutes to two through parallelization; with the team's first automated test suites, static analysis and security scanning added, the full quality-gated build runs in about seven minutes.
Designed enterprise auth for internal agency applications: Kerberos/SPNEGO SSO, AD fallback for identity attributes, CSRF protection, and database-sourced role and permission resolution.
Encoded team conventions in tooling: a pull request template with an explicit checklist, shared EditorConfig and Prettier rules, and a build that fails on violations.
More highlights
Halved sprint cadence from four weeks to two, trading batch size for faster feedback and stakeholder visibility.
Chose composition over inheritance where the query pattern demanded it, replacing a 20-way JPA JOINED hierarchy with shared-primary-key @MapsId extension tables so each subtype joins only its own extension, and collapsing ~120 near-identical options tables into two generic reference tables served by a single service.
Resolved a circular dependency in PostgreSQL that had defeated previous teams by reshaping the data model from tree to graph.
On a shared Angular and Spring Boot codebase with a dozen developers, introduced a shared component library as a time-saver rather than a mandate; adoption spread on its own because the components were faster to use.
Presented a catalogue of inherited technical debt to the steering committee with concrete numbers, framed around risk and delivery rather than blame, including funded work that had to be discarded.
Quality enforced in the pipeline: SonarQube analysis with a gate the build fails on, plus lint and format rules applied on every merge.
Outside the agency, built CI/CD pipelines with Gitea Actions and containerized delivery on self-hosted infrastructure, the same two-stage build-and-deploy pattern used on the agency's Jenkins pipelines.
On my own product work, built a multi-tenant SaaS on Cloudflare Workers, Hono, and D1 (chosen for zero cold starts and edge deployment, with the vendor lock-in accepted explicitly), using one database per tenant rather than row-level tenancy for hard PHIPA tenant isolation.

Education. BSc (Honours) Computer Science, Computer and Network Security stream, Carleton University, Ottawa, December 2017.

Strengths

Legacy system modernization without losing domain fidelity
Java and Spring architecture for long-lived enterprise software
Workflow-heavy systems, state models, and integration boundaries
Auditable systems: revision history designed into the domain model, with explicit opt-outs where audit adds noise rather than value
Self-hosted infrastructure, CI/CD, and practical platform ownership
Explicit boundaries for AI-assisted work, and the categories where the decision stays human

Stack

  • Java
  • Spring Boot
  • Angular
  • TypeScript
  • Hibernate/JPA
  • Flowable BPMN/CMMN/DMN
  • REST APIs
  • PostgreSQL
  • Redis
  • JUnit
  • Playwright
  • SonarQube
  • Jenkins
  • Gitea Actions
  • Docker
  • Linux

Hiring for regulated or governed-AI work?

I'm looking for senior engineering roles building and maintaining services where the work has to answer for itself: workflow and integration platforms, governed AI, and regulated environments. Based in Ottawa, open to hybrid or remote.