~/sarthak-doshi v3.0

AI Engineer — Full-time roles & freelance builds · accepting projects

SarthakDoshi

I design, build, and secure production AI — for companies, and for clients who need it shipped.

AI agents, RAG systems, guardrails, ML models, and full-stack products — taken from first scope to deployed, tested, and monitored.

AI/ML Engineer @ Green Story  ·  Freelance: open  ·  Vice Chair, AITR ACM  ·  B.Tech CS '26

58
projects built
12
languages
34k
LOC — largest system
500+
automated tests written
[01]SECTION services — open for engagements

What I can build for you

Available for freelance and contract work alongside full-time conversations. Every service below is backed by shipped projects — scroll down for the proof.

AI Agents & Chatbots

Custom assistants for your product or operations — multi-agent workflows, tool-calling, voice agents, web bots. Built with state machines and fallbacks so they behave in production, not just in demos.

proof: production DPP creation agent · SupportDesk AI · realtime voice agent · A2A travel planner
OpenAILangGraphMCPFastAPI

RAG & Knowledge Systems

Chat with your documents, grounded answers over your data, semantic search inside your app. Six RAG systems built across four vector stores — plus a harness that measures which retrieval setup actually wins on your data.

proof: hybrid BM25 + vector + reranker chatbot in production · 4-arm evaluation harness · GraphRAG
RAGFAISSEmbeddingsEvals

AI Security & Guardrails

Prompt-injection defence for your LLM features, security scanning of your web app, and EU AI Act readiness. I have built the guard layer twice and validated the scanner against live production domains.

proof: AegisAI 5-layer guard · BugZapper DAST — 77 critical findings across 53 live scans · EU AI Act engine
OWASP LLMDASTEU AI ActRed-teaming

ML Models & Analytics

Prediction, matching, forecasting, recommendation — plus the dashboards to see it. From a TF-IDF product matcher running in production to full MLOps loops with drift detection and automated retraining.

proof: production SKU matcher · Snowflake champion/challenger pipeline · Power BI dashboards
scikit-learnPyTorchSnowflakePower BI

Full-Stack Product Builds

MVPs, internal tools, and complete platforms — backend, frontend, database, deployment. Comfortable across Python, Go, and TypeScript, with real CI/CD and tests, not just a working demo.

proof: AegisAI (~34k LOC, 356 tests) · Checkora (328-commit Django platform) · SupportDesk AI (multilingual RAG SPA)
GoNext.jsFastAPIPostgreSQL

Automation & Data Extraction

Turn documents, websites, and manual workflows into structured data and automated pipelines — OCR on invoices and certificates, scraping with headless-browser fallbacks, scheduled jobs and alerting.

proof: PO / certificate extraction in production · URL-import pipeline · outreach automation agent
TextractPlaywrightPyMuPDFCron / Queues

Typical engagements: a scoped build (2–8 weeks), an audit, or ongoing retainer work. Tell me what you need →

[02]SECTION projects — 13 of 58 shown

Selected projects

The flagships — proof of everything listed under services. 13 shown of 58 built across open source, research, coursework and client work; the public record lives on GitHub ↗.

AegisAI

Open-source AI governance, risk & compliance platform. Classifies AI systems against EU AI Act risk tiers with statutory citations, generates required documentation, defends live LLM endpoints with a five-layer prompt-injection guard (regex + fine-tuned DeBERTa), and answers regulatory questions with groundedness-scored RAG.

~34,000 LOC · 356 tests · 288 commits · 6 Alembic migrations · K8s HPA manifests · SDK + MCP server + Chrome extension
securityeu ai actFastAPIPyTorchReactFAISS

BugZapper

A 20-check DAST engine for web security scanning, validated against 53 live scans of Indian government production domains — surfacing 77 critical and 236 high-severity findings.

144 unit tests · 53 live scans · 77 CRITICAL / 236 HIGH findings
offensivePythonDASTAppSec

Cyber Defense SOC Platform

Seven LangGraph agents cooperating over a Redis blackboard to triage security events — MITRE ATT&CK technique mapping, CVSS v3.1-to-v2 fallback parsing, per-agent exception isolation so parallel dispatch can't cascade.

~5,900 LOC · 7 agents · regex pre-filters · temperature 0.1 · bounded fan-out
securityagenticLangGraphRedis

LLM Prompt-Injection Guard

Standalone five-layer defence pipeline: Unicode NFKC normalisation with 49-entry homoglyph canonicalisation → severity-graded regex families → fine-tuned DeBERTa-v3-small intent classifier → a named-rule decision ladder (0.4 regex / 0.6 intent) → recovery-oriented sanitiser. Mapped to OWASP LLM01/LLM02/LLM07.

custom Dataset/DataLoader/warmup schedule · max-severity scoring prevents false-positive stacking
securityPyTorchTransformersOWASP

EU AI Act Compliance Engine

Risk-tier classification as an executable Article 5 → Annex III → Article 52 precedence cascade — a 16-signal pure-function rules engine chosen over an LLM, because a regulator must be able to replay every decision. Cross-walked to NIST AI RMF subcategories.

deterministic by design · statutory citations on every factor · prohibitions short-circuit at confidence 0.99
governancePythonNIST AI RMF

AI Data Analysis — Text-to-SQL

Natural-language analytics over a production Databricks warehouse — with a deterministic SQL firewall between GPT-4 and the data: a statement-prefix whitelist and nine-verb deny-list the model cannot influence.

5,137 lines · non-LLM validation gate · query-scoped tenancy in the WHERE clause
securityGPT-4DatabricksSQL

Snowflake Healthcare MLOps

A complete champion/challenger model lifecycle inside Snowflake: warehouse-native features that eliminate training-serving skew, a three-model bake-off, daily scoring, weekly retraining gated on live production error, KS drift detection, and atomic model cutover.

6,474 lines · 2% improvement threshold so models don't churn on noise · deprecate-then-insert cutover
mlopsSnowflakePythonDrift Detection

Intersectional Fairness Audit

A 10-page IEEE-format audit of income-prediction models across 29 Gender × Race × Age subgroups — nine of which received zero positive predictions at DIR 0.00 against the legal 0.80 four-fifths threshold. Independently verified and corrected a third-party fairness-metrics library along the way.

IEEE paper · EEOC four-fifths rule applied · AIF360 dtype failure independently debugged
researchFairnessResponsible AI

Risk Game Bots — PPO from scratch

A PPO agent for the board game Risk with a variable action space of hundreds of legal moves — GAE, clipped surrogate objective, orthogonal initialisation and linear LR annealing written by hand, trained to 1,000,000 timesteps. Evaluated in a seat-swapped round-robin tournament that controls for first-player advantage.

6,087 LOC · no RL framework · 1M timesteps · controlled evaluation
rlPyTorchPPOPython

Four-Strategy RAG Harness

A controlled four-arm experiment built so retrieval architecture is the only variable — with a real 80-row results CSV including negative results, reported honestly. One of six distinct RAG systems in the portfolio spanning four vector stores.

measurement over assertion · honest negative results · reproducible seeded splits
researchRAGEvaluation

SupportDesk AI

Multilingual RAG customer-support agent (final-year major project) — a substantial SPA with no build step, a three-tier knowledge-source cascade with explicit fallbacks, and 3,000+ lines of architecture documentation treated as a first-class deliverable.

multilingual retrieval · graceful degradation cascade · docs-as-deliverable
agenticRAGFastAPIJS

Investment Survey Dashboard

Power BI dashboard analysing investment behaviour across demographics, income bands and goals — interactive drill-downs, DAX measures and segment comparisons, built to be read by non-technical stakeholders.

DAX measures · demographic segmentation · interactive drill-down
analyticsPower BIDAXData Viz

Financial Data SQL Analysis

Advanced SQL analysis over financial transaction data — multi-table joins, subqueries, window functions and query optimisation, with schema normalisation for reporting workloads.

window functions · query optimisation · normalised reporting schema
analyticsSQLWindow Functions
[03]SECTION experience — verified

Experience

Production AI for sustainability intelligence — shipped inside a live multi-service platform used by real customers.

AI/ML Engineer

Green Story — sustainability & carbon-intelligence platform
JAN 2025 — PRESENT
REMOTE

Core engineer on an enterprise AI platform for carbon footprinting, Life Cycle Assessment and supply-chain intelligence — 16 containerised FastAPI microservices backed by PostgreSQL, Redis, MongoDB and AWS, shipped to four environments through a per-service change-detection CI/CD pipeline.

⚠  Sanitized under NDA — goals, techniques and outcomes are described below; client names, internal identifiers and deployment specifics are withheld.

Agentic Product-Passport Creation Subsystem agentic

A ~26,000-line multi-agent subsystem that assembles Digital Product Passports conversationally — an explicit state-machine coordinator and a declarative save-operation registry where every backend write flows through one persistence choke point: a save is reported only if the backend actually accepted it, unchanged values are never re-sent, and every failure records the backend's own error code.

state-machine orchestration · dependency-graph writes · 40-file offline test suite · cron-precomputed suggestion cache with negative caching

SSRF-Guarded Product-Page Import security

A four-stage URL-import pipeline for the passport agent: SSRF-guarded, size-capped fetch with headless-render fallback → static parse of structured markup (no LLM) → one JSON-mode LLM pass over the cleaned signals → resolution against internal catalogues, where anything unmatched is flagged for support — never silently guessed.

redirect-by-redirect fetch guard · playwright · structured-output llm · flagged-not-guessed resolution

Hybrid-Retrieval Chatbot + Federated Analytics rag

Re-architected a production chatbot to hybrid BM25 + vector retrieval with cross-encoder re-ranking and Redis caching; then built its analytics product — persistent conversation storage, a dashboard that federates four isolated environments (direct DB reads where reachable, service-to-service HTTP where not), CSV export, and automated alert emails for unanswered questions.

bm25 + embeddings + cross-encoder · redis · mongodb · aws ses w/ smtp fallback · coverage-gap metrics

"AI Proposes, Rules Dispose" Decision Engines guarded llm

The platform's decisioning pattern: an LLM proposes a selection from database candidates, and a deterministic guard layer disposes — enforcing domain invariants like flag gating, dedup and mandatory steps — with an AI circuit breaker that falls back to pure rules when failure rates spike. Deterministic spec-sheet parsers resolve locations against live geography tables and flag what they can't match.

llm + deterministic guards · ai circuit breaker · fuzzy cascade matching · deterministic fallbacks

Matching & Extraction Engines ml

A family of matchers linking messy external data to internal catalogues: hierarchical SKU matching (exact → external ID → TF-IDF cosine) streaming batch results over Server-Sent Events with config-driven scoring, PO line-item matching, n-gram material matching, and a four-tier process cascade (exact → fuzzy → AI-assisted → flagged fallback). Plus queue-driven document extraction from purchase orders, BOMs and compliance certificates with field-level confidence scoring that routes low-confidence documents to human review.

scikit-learn tf-idf · sse streaming · aws sqs + textract · confidence-thresholded review routing · transactional commit w/ rollback

Realtime Voice & Media Generation llm

Browser voice agents on the OpenAI Realtime API using the ephemeral-key WebRTC pattern — audio never proxies through the backend — with RAG tool-calling over a vector knowledge base and helpdesk ticketing, including an OAuth2 vendor migration. Plus a narrated-video pipeline (speech-to-text → TTS → avatar render → ML background segmentation → FFmpeg composition) with an engine pin that prevents a 4× render-cost regression.

openai realtime · whisper · chromadb · webrtc ephemeral keys · ffmpeg + mediapipe · oauth2 refresh-token flow
  • Helped migrate the platform's CI/CD to GitHub Actions with per-service change detection — only services that changed get rebuilt and redeployed.
  • Root-caused a cross-service production hang to a connection-pool leak — unmatched non-GET routes opened DB transactions that nothing ever released — then hardened the fleet: constant-built URLs, GET-only capability probes, health checks that bill zero LLM tokens, fixed container health probes, patched JWT-library CVEs.
FastAPIOpenAI APIPostgreSQLRedisMongoDBChromaDBLangChainAWS SQS/SES/TextractDockerGitHub ActionsPlaywrightscikit-learnFFmpeg
OUTCOMES three problems, what was built, and what changed
case · catalogue matching

problemA sustainability platform's ops team hand-matched thousands of retailer products to internal footprint data.

builtA hierarchical matching engine — exact → ID → text similarity — streaming batch results live, every threshold config-driven.

outcomeMatching runs unattended; ops re-tune scoring themselves, no engineering release needed.

case · support coverage

problemA production chatbot answered most questions — nobody knew which ones it missed, or for whom.

builtHybrid retrieval plus a federated analytics dashboard across four isolated environments, with alert emails on unanswered questions.

outcomeCoverage gaps became a metric; missed questions reach the team's inbox the moment they happen.

case · security exposure

problem"How exposed are we, actually?" — the question every public web app owner avoids.

builtA 20-check DAST scanning engine, validated against 53 live production domains.

outcome77 critical and 236 high-severity findings surfaced — before an attacker found them.

Data Science Intern

Sabudh Foundation
JUL 2024 — DEC 2024
INDORE, IN

End-to-end data science fellowship work: cleaning, feature engineering, and model development on real datasets alongside senior data scientists — culminating in a 14-week portfolio of 100+ algorithm implementations, from classical ML through deep learning and NLP.

PythonSQLMachine LearningDeep LearningNLPData Visualization
[04]SECTION stack — verified

Stack

Grouped by where it shows up in the work — every item below is backed by a shipped project.

Languages

Python TypeScript JavaScript Go C++17 C SQL Dart Kotlin Swift Solidity Bash PowerShell HTML5 CSS3

AI Security & Governance

Prompt-Injection Defence OWASP LLM Top 10 EU AI Act NIST AI RMF MITRE ATT&CK GDPR DAST Fairness Auditing AIF360 SHAP LIME JWT OAuth 2.0 AES-256-GCM pip-audit

LLMs & Agents

Claude Code Claude API OpenAI GPT-4o Gemini Groq Llama 3 Ollama DeepSeek-R1 Qwen Mistral Hugging Face AWS Bedrock Together AI vLLM LM Studio Whisper ElevenLabs LangChain LangGraph CrewAI MCP A2A Protocol RAG Pipelines Multi-Agent Systems Tool Calling Realtime Voice

Retrieval & Vector Search

FAISS ChromaDB Qdrant Annoy Elasticsearch Sentence-Transformers OpenAI Embeddings tiktoken PyMuPDF Tesseract OCR

Machine Learning & Data Science

PyTorch TensorFlow Keras scikit-learn XGBoost Transformers ONNX Runtime Unsloth / QLoRA Stable-Baselines3 Gymnasium OpenCV YOLOv8 MediaPipe TensorFlow Lite spaCy NLTK NumPy pandas SciPy NetworkX Matplotlib Seaborn Plotly Jupyter Google Colab Streamlit MLflow TensorBoard Roboflow

Data & Databases

PostgreSQL Neon MySQL SQLite MongoDB Redis Snowflake Databricks DuckDB Parquet SQLAlchemy Alembic Prisma AWS S3 Cloudflare R2 Tableau Power BI

Software & Web

FastAPI Django Flask Pydantic Node.js Fastify Next.js React Svelte / SvelteKit Vite Tailwind CSS shadcn/ui Radix UI Zustand TanStack Query React Router React Hook Form Zod Three.js D3.js Chart.js Recharts Swagger / OpenAPI WebSockets Stripe Firebase Twilio Selenium Playwright

Mobile, Embedded & Web3

React Native Flutter Android iOS ESP32 / ESP-IDF FreeRTOS raylib Chrome Extensions Ethereum Polygon Web3.py IPFS MetaMask

Platforms & DevOps

AWS AWS Lambda AWS EC2 Google Cloud Docker Kubernetes GitHub Actions Git GitHub Linux Ubuntu Nginx Vercel Netlify Render Heroku Cloudflare Let's Encrypt Prometheus Grafana OpenTelemetry Sentry PyPI npm pnpm uv

Testing & Quality

pytest Vitest Jest Postman ESLint Prettier Black mypy pre-commit VS Code
[05]SECTION education — verified

Education & certifications

B.Tech, Computer Science (Data Science)

Acropolis Institute of Technology and Research
2022 — 2026 · CGPA 8.02 / 10

Specialised in Data Science: machine learning, deep learning, NLP, DBMS, statistics, and data structures & algorithms.

Higher Secondary (PCM)

Indore International School
2020 — 2022 · 82.4%

Physics, Chemistry, Mathematics and Computer Science.

Dataiku

HackerRank

Sabudh Foundation

  • Deep LearningA+ · Jan 2025
  • Machine LearningA+ · Jan 2025
  • Data Structures & AlgorithmsA+ · Jan 2025
  • Python ProgrammingA+ · Jan 2025
  • NLP & Recommender SystemsJan 2025

NPTEL

[06]SECTION leadership — verified

Leadership & recognition

leadership

Vice Chairperson, AITR ACM Student Chapter

Lead the technical community: event planning, workshops, hackathons. Previously Technology Trainer (2023–24), running sessions on programming and data structures.

▸ 100+ students trained · 40+ events hosted — tech conferences, hackathons, workshops, sessions
competition

AIML Fusions Hackathon — Winner

First place for an AI/ML solution built under competition constraints.

▸ 1st place
speaking

Conference Talks — DEVFEST

Two delivered talks on AI literacy and the GenAI threat landscape, including a live synthetic-media deception demo.

▸ 2 conference talks delivered · 25+ events anchored
community

PRAWES National NGO — Volunteer

Community development and social-welfare initiatives supporting underprivileged communities; regular anchoring and public speaking at college and community events.

▸ ongoing community service
[07]SECTION contact — channel open
01 · SCOPE
Scope call

Free, ~30 min. You describe the problem; I tell you honestly if and how it's buildable.

02 · QUOTE
Fixed scope & quote

Written scope, timeline and price before any commitment. No open-ended billing.

03 · BUILD
Weekly demos

Working software every week — not a big reveal at the end. Course-correct early.

04 · HANDOVER
Docs, tests, source

You own everything: repository, tests, deployment docs, and a walkthrough.

remote-first · IST (UTC+5:30) — overlaps EU & US mornings · replies within 24h

Hiring full-time, or need something built?

I take on freelance and contract projects — AI agents, RAG systems, automation, ML models, security audits, and full-stack builds — alongside conversations about full-time AI / ML roles. Send a couple of lines about what you need and I'll reply with a scope, a timeline, and an honest feasibility take.