Available Now · PHP/Backend · EMEA Remote · Immediate Start

When your backend can't afford to fail.

I've built and hardened production infrastructure for House.gov, NOAA, DISA, and DoD contractors — and recovered a state-sponsored attack with zero data loss in 48 hours. 25 years of mission-critical PHP/Symfony delivery. Actively seeking a permanent senior IC role on an EMEA-remote backend team.

I'm Hiring ↗ View CV View My Work

Work-authorised — EU & US · EMEA remote · Available immediately · Full CV ↗

25+

Years Delivering

10+

Federal Clients

99.5%

Uptime Delivered

"Eric's proactive approach to security saved us from potential disasters multiple times. I'd bring Eric back without hesitation for anything involving federal-scale infrastructure."

Viktoria Hotvianska · NOAA Federal Infrastructure

Las Palmas, Spain — Remote

eric.maag@gmail.com

+34 675 741 692

Eric Maag

Senior Backend Engineer

GitHub ↗ LinkedIn ↗

GovernmentStack.php

// US Federal Government · Contractor
// House.gov · NOAA · USDA · DISA · NAVSUP
 
$clients = [
    'House.gov'   => 'DevOps + Email',
    'NOAA'        => '99.5% uptime',
    'USDA'        => 'Solr + Tika',
    'DISA.gov'    => 'x509 / PKI',
    'NAVSUP.mil'  => 'cert hardening',
];
          

Proof of Work

When the Attack Landed at 3am

2005 · International Trade Association · Incident Response

OIDA: State-Sponsored Attack Recovery

48-hour full recovery · $100K+ in fees protected · Zero data loss

The Situation

The Optoelectronics Industry Development Association ran their annual membership conference on a custom PHP platform. Three weeks before their flagship conference, a state-sponsored threat actor compromised the system — corrupting membership data, locking admin access, and exposing payment records. The board was 48 hours from canceling the event and refunding $100K+ in fees.

The Constraint

No offsite backups. No source control history past 6 months. Registrations were still processing from international attendees. Any extended downtime meant refunds, reputational damage, and potential PCI liability. I had one weekend.

What I Built

Forensic analysis identified the vector: an unpatched file upload handler that had been backdoored. I isolated the instance, recovered the database from transaction logs (there was no snapshot), and rebuilt with a hardened multi-tier architecture — separating the public form, payment processor, and admin panel into isolated access contexts, with audit logging on every state change.

Why It Was Hard

Recovering from no backup, under active conference load, while ensuring no persistent attacker access, while keeping live registrations processing. The normal answer is "restore from backup." There was no backup. There was no acceptable data loss.

Outcome

48h

Full recovery

Zero

Data lost

$100K+

Fees protected

25 hrs/mo

Overhead eliminated

Conference ran on schedule. The rebuilt architecture ran three subsequent conference cycles without incident and eliminated 25 hours/month of manual reconciliation between the payment processor and registration database.

PHPIncident ResponseForensic RecoveryPCI-scoped ArchitectureCustom RBACMySQL

Core Strengths

What I Bring to Your Backend Team

PHP 8.x · Symfony · DDD · CQRS · RabbitMQ · Kafka

Event-Driven Microservices

At Signa Sports United I built the microservices backbone processing 50K+ product events daily across international markets — Symfony on RabbitMQ with Kafka, Redis, and MongoDB. I've shipped event-driven systems from greenfield and kept them running under sustained production load.

Symfony 4–7 / Laravel 9–11 / PHP 8.x
DDD · CQRS · Hexagonal Architecture
RabbitMQ · Kafka · Redis pub/sub
Doctrine ORM · PHPUnit · TDD

NOAA · House.gov · DISA · NAVSUP · EPA

Mission-Critical Systems

A decade contracting for US federal agencies taught me what uptime and security really mean. I maintained 99.5% availability for millions of users, hardened PKI/TLS across DoD infrastructure, and recovered a live platform from a state-sponsored attack in 48 hours — no backups, zero data loss.

Multi-region HA deployments
x509 / PKI / TLS hardening
Incident response & forensic recovery
PCI-scoped architecture & compliance

Team Lead · Architecture · Hiring · Mentorship

Engineering Leadership

At Signa Sports I managed four senior engineers — hiring decisions, performance reviews, architecture calls, and delivery across concurrent projects. I'm equally comfortable as a senior IC or leading a small backend team, and I write code either way.

Led 4-person senior backend team
Architecture decisions & trade-off analysis
Hiring · onboarding · performance reviews
PHPWorld speaker 2016–2020

Testimonials

What Colleagues & Clients Say

Viktoria Hotvianska

NOAA — Federal Infrastructure

Eric's deep expertise in Drupal and server infrastructure was critical to keeping our systems running at 99.5% uptime. His proactive approach to security saved us from potential disasters multiple times. I'd bring Eric back without hesitation for anything involving federal-scale infrastructure.

Frank Feulner

Signa Sports United — Enterprise

Eric led our microservices migration with precision. The AI-driven translation pipeline he built reduced our localization effort by 40% and the team trusted his technical leadership completely. Eric's the kind of technical lead you want when the project has no margin for error.

Arvic Arevalo

Philippine Embassy — Multi-Tenant CMS

When we needed someone to architect a multi-tenant CMS spanning 18 consulate sites, Eric delivered a solution that drastically cut our content management overhead while maintaining a unified brand. He delivered under a scope no other vendor was willing to take on.

Rodrigo Antolin

CQM Rewards

I've had the pleasure of working with Eric and I can confidently say he is an exceptional developer. His technical expertise is outstanding, consistently delivering high-quality code and innovative solutions. Beyond his skills, he is a proactive problem-solver, a collaborative team player, and always eager to learn and share knowledge. His attention to detail and dedication to excellence make him an invaluable asset to any project. I highly recommend Eric for any opportunity. He truly elevates every team he joins.

Featured Work

Federal Agencies, Global Enterprises, Complex Systems

GitHub ↗

US Federal · DevOps

Zero-error launches · Constituent email at congressional scale

US House of Representatives

Contracted to House.gov to build and deploy official websites for incoming congressional members via a standardized DevOps pipeline. Automated provisioning of Drupal-based member sites across multiple offices, and architected bulk constituent email broadcast systems managing large-scale district mailing lists.

DrupalCI/CDBashEmail InfrastructureLinux

house.gov ↗

DoD · Security

Zero non-compliance findings · PKI across DoD infrastructure

DISA & NAVSUP Security Hardening

Security contractor for the Defense Information Systems Agency (DISA.gov) and Naval Supply Systems Command (NAVSUP.mil). Implemented x.509 certificate infrastructure and PKI-based authentication hardening across DoD web properties to meet federal security standards.

x509 / PKITLS HardeningCert ManagementDoD Compliance

disa.mil ↗

Enterprise

40% less translation effort · 30% faster loads · 50% faster processing

Signa Sports United

Led team building scalable microservices architecture for a multi-brand sports retail conglomerate. Implemented AI-driven translation services and CI/CD pipelines across international markets.

SymfonyDockerMongoDB

linkedin.com/company/signa-sports-united ↗

Government

99.5% uptime · $150K annual cost savings

NOAA Infrastructure

Architected a high-availability system across 3 US colocation centers. Automated database replication ensuring zero downtime for millions of users nationwide.

DrupalMySQLBashMulti-Region

noaa.gov ↗

Government · Data

National-scale real-time data · Automated ingestion replacing manual pipelines

USDA Crop Yield Aggregation

Built a real-time data aggregation platform for the US Department of Agriculture to compile and publish national annual crop yield reports. Integrated Apache Solr for high-speed indexing and Tika for automated document parsing from structured field reports.

DrupalApache SolrApache TikaMySQLLinux

usda.gov ↗

Security · Incident Response

48h recovery · Zero data loss · $100K+ fees protected

OIDA Security Recovery

Recovered from a state-sponsored cyberattack in 48 hours with no backups and live registrations still processing. Rebuilt with a hardened multi-tier architecture with audit logging on every state change.

Incident ResponseForensic RecoveryPCI-scoped ArchitectureMySQL

oida.org (archive) ↗

Fintech · Banking · Nonprofit

PCI-compliant payment infrastructure · Multi-currency · 20+ countries

FINCA International

Built and maintained the digital infrastructure for FINCA International, a global microfinance bank operating across Africa, Asia, Latin America, and Eastern Europe. Integrated PCI-compliant payment gateways handling multi-currency donations across multiple regulatory jurisdictions. Managed ongoing security updates and platform maintenance for their Drupal presence spanning 20+ country operations.

DrupalPayment GatewayPCI ComplianceMulti-currencyPHP

finca.org ↗

Multi-Tenant

60% reduction in content management overhead · 18 sites

Philippine Embassy CMS

Built a sophisticated multi-tenant CMS managing 18 consulate microsites with centralized administration, inherited branding, and role-based access control.

CMS Made SimpleMulti-TenantRBAC

philippineembassy-dc.org ↗

Media

1,000+ articles/day automated · 4 agencies integrated

UPI News Platform

Custom news aggregation platform processing content from multiple international agencies with automated billing and editorial workflow management.

PHPXMLMySQLCustom CMS

upi.com ↗

Backend

90%+ bugs resolved within SLA

Nuro Media Backend

Scalable PHP backend applications built on clean architecture, with automated testing pipelines and performance optimization via Symfony and Doctrine ORM.

PHPSymfonyPHPUnitDoctrine ORM

nuromedia.com ↗

Personal · SaaS

60+ applications tracked · Active daily · Solo-built

statichex.dev/pipeline

Custom PHP/SQLite job search CRM built to my exact workflow — not a spreadsheet, not a JIRA board. Tracks applications by stage, manages DACH agency outreach, strategy notes, daily task list, and dashboard analytics. Auth-gated, zero external dependencies, deployed on shared hosting.

PHPSQLiteSymfony patternsAJAXPersonal tool

Active daily use. Started as a lightweight tracker — grew into a full CRM with dashboard, DACH agency module, strategy notes, and pipeline analytics.

statichex.dev/pipeline ↗

Philosophy

I help organizations take back control of their own systems.

Too many engineering teams are held hostage by complexity they didn't choose. I build systems that are honest — where the architecture matches the problem and the next engineer can own it without a two-week handoff.

How I approach engineering →

Architectural Honesty

I match the solution to the actual problem — not the most fashionable pattern. Every abstraction earns its place. Complexity is only introduced when simplicity has been exhausted.

Ownership by Design

Systems I build are meant to be handed off. Documentation, naming conventions, and pipelines are treated as first-class deliverables — not afterthoughts.

Security as a Baseline

After recovering government infrastructure from a state-sponsored attack in 48 hours, I treat security as a foundation — not a feature sprint. Embedded in architecture from day one.

Technical Expertise

Stack & Specialisms

Backend

PHP 8.xSymfonyLaravelDrupal 6–10Doctrine ORMPHPUnitBashLinux

Architecture

DDDCQRSHexagonalSOLIDTDDEvent-DrivenMicroservicesRESTGraphQL

Messaging & Data

RabbitMQKafkaRedisMySQLPostgreSQLMongoDB

DevOps & Cloud

DockerKubernetesAWSGCPCI/CDJenkinsBamboo

Security & Compliance

x509 / PKITLS HardeningIncident ResponsePCI ScopeDoD Compliance

Human Languages

English · nativeSpanish · fluentGerman · fluentFrench · intermediate

Role Preferences

What I'm Looking For

What kind of role?

Permanent. Senior backend IC or technical lead. Not contract or interim — I want to join a team and stay. EMEA remote only; I'm based in Las Palmas, Gran Canaria (UTC+1, full overlap with CET). I'm actively interviewing and can start immediately.

Preferred stack?

PHP 8.x / Symfony is primary. Laravel, event-driven microservices (RabbitMQ, Kafka), DDD/CQRS, clean architecture. MySQL, PostgreSQL, MongoDB, Redis. Docker, Kubernetes, CI/CD. I pick up well-structured codebases quickly and have strong architectural opinions without being dogmatic about them.

Work authorisation — where can you work?

Swiss citizen, Spanish resident. EU-authorised everywhere without sponsorship, visa, or compliance overhead. Also US-authorised (Georgetown grad). For DACH roles the Swiss citizenship plus fluent German tends to matter to end clients — no friction on either side.

When can you start?

Immediately. No notice period. I can join, onboard, and contribute within the first week. I prefer codebases with CI/CD and test coverage — but I've ramped up in worse and left things better than I found them.

What does your ideal team look like?

Backend-focused, with engineers who care about what they ship. Greenfield or legacy both work — I've done both at scale. I don't need hand-holding but I do need to be trusted with technical decisions. Strong preference for teams building something that has real engineering problems to solve.

Senior IC or technical lead — which do you prefer?

Either. At Signa Sports I led four senior engineers across concurrent projects. At NOAA and during federal contracting I operated as a senior IC. What matters more than the title is whether the technical quality of the work matters to someone else on the team.