Muji Dipto

Nov 2026 – Present

Senior Software Engineer, OnEarly

Oct 2025 – Oct 2026

Senior Software Engineer, Oracle (Brisbane, QLD)

• Own the software composition analysis (SCA) service and the risk-scoring platform covering 15,000 software packages, leading backend development, OCI deployment and production operations.
• Built a rule-based CocoaPods vulnerability-report curation system from scratch in Python, reducing a 4,500-report backlog by 73% and saving 960+ analyst-hours.
• Improved Java/Maven scan reliability in an enterprise scanning platform on OCI and Kubernetes (OKE), with queue-based orchestration and event-driven result processing.
• Designed, built and deployed an Oracle APEX document approvals application within one week using AI-assisted development.

Aug 2022 – Oct 2025

Software Engineer, Oracle (Brisbane, QLD)

• Led the design and Java/Micronaut development of the SCA Scoring service.
• Redesigned REST API response schemas and caching to improve throughput and reliability in SCA Scoring.
• Built a CLI tool for analysts to generate software bills of materials (SBOMs) and score software packages in optimised batches.
• Developed Python ingestion pipelines using Apache Airflow, with concurrency controls, exponential backoff and rate-limit handling to keep scoring data current.
• Led development of a SAST findings dashboard; created Figma designs and React/Oracle JET prototypes following WCAG and Oracle design standards.

Jan 2022 – Jul 2022

Security Analyst, Oracle (Brisbane, QLD)

• Designed a common schema for NVD and OSV vulnerability data that became the standard for subsequent source integrations.
• Built Python dependency-analysis and ingestion pipelines for Go and Objective-C, automating SBOM processing and handling ecosystem-specific formats and edge cases.

Feb 2020 – Jan 2022

Casual Tutor, Web Design and Development, The University of Queensland (Brisbane, QLD)

• Taught approximately 90 students per semester across HTML, CSS, JavaScript, prototyping and user-centred design, with strong evaluations for clarity and approachability.

SCA risk-scoring platform

Oracle, Aug 2022 to Oct 2026

15,000 packages risk-scored daily; data refresh cut by 77%, 2 hours to 28 minutes

problem

A software composition analysis service that gives open-source packages a security risk score. Security analysts used the scores to triage and prioritise.

hard

• -15,000 packages to assess.
• -Scores had to come back quickly whenever someone queried one.
• -Scoring depended on external APIs that are slow and rate-limited.

approach

• -Scores are computed ahead of time, not on request: data pipelines refresh them continuously and the service answers from its own database.
• -Exponential backoff and rate-limit handling keep the pipelines moving through slow external APIs.
• -Database indexing, query optimisation and caching keep both the refresh and the lookups fast.

# what I did

• Led end-to-end delivery of a risk-scoring service assessing 15,000 software packages daily.
• Led the design and Java/Micronaut development of the SCA Scoring service.
• Redesigned REST API response schemas and caching to improve throughput and reliability in SCA Scoring.
• Cut data-refresh time by 77%, from 2 hours to 28 minutes, through query optimisation and smarter caching.
• Developed Python ingestion pipelines using Apache Airflow, with concurrency controls, exponential backoff and rate-limit handling to keep scoring data current.

stack: Java, Micronaut, Python, Apache Airflow, OCI

CocoaPods vulnerability curation

Oracle, Senior Software Engineer

960+ analyst-hours saved; a 4,500-report backlog cut by 73%

problem

Security analysts curated raw vulnerability reports for the CocoaPods ecosystem by hand, one at a time, and a backlog of 4,500 reports had built up.

hard

• -Each report took an analyst a long time to curate by hand.
• -Little ground truth: only a small set of reports had been curated, too few to build a proper solution on directly.

approach

• -Studied the small curated set to find the patterns the analysts followed.
• -Built a rule-based curation system from those patterns, using public vulnerability metadata such as CVE and CPE records.
• -Ran the rules over the raw backlog to curate reports and filter out false positives.

# what I did

• Built a rule-based CocoaPods vulnerability-report curation system from scratch in Python, reducing a 4,500-report backlog by 73% and saving 960+ analyst-hours.

stack: Python

World Cup Newsletter Platform

Personal project, deployed

A daily newsletter per subscriber, from live football APIs, written by an LLM

problem

Every morning of the 2026 World Cup, each subscriber gets an email about the team they follow: yesterday's result, the group standings, what the media is saying and the next fixture in their own timezone. Written by an LLM, sent without manual work.

hard

• -Four free data sources to combine (football-data.org, ESPN, TheSportsDB and The Guardian), one of them strictly rate-limited.
• -An LLM writing about real matches, where a made-up scoreline would be a serious error.
• -Free tiers throughout: the LLM API rejects bursts of requests, and hosting had to cost nothing.

approach

• -A Java pipeline fetches every source concurrently on a bounded worker pool, with exponential backoff around each call (skipping errors that cannot succeed) and a rate limiter for the strictest API.
• -Each subscriber's facts are bundled from SQLite and sent to a Python FastAPI service, where the LLM writes the email under a strict rule: state only facts present in the bundle.
• -Emails are composed one request at a time to stay within the LLM's free tier, and a failure goes to a dead-letter list instead of stopping everyone else's email.
• -Runs daily from cron on an Oracle Cloud Always Free virtual machine behind nginx, so it costs nothing to run.

# what I did

• Built and deployed a Java and Python platform that ingests data from multiple live APIs and uses an LLM (Llama, through Groq) to generate personalised newsletters.
• Implemented bounded worker pools, prioritised scheduling, fan-out and retry handling to coordinate concurrent requests across rate-limited APIs and the LLM provider.

stack: Java, Python, FastAPI, SQLite, Groq (Llama), Oracle Cloud

repo: github.com/MujiDipto/fifa-wc-newsletter (opens in a new tab)

SAST findings dashboard

Oracle, Software Engineer

Designed and prototyped a SAST findings dashboard to WCAG and Oracle standards

• Led development of a SAST findings dashboard; created Figma designs and React/Oracle JET prototypes following WCAG and Oracle design standards.

stack: Figma, React, Oracle JET

dipto.dev, this terminal

Personal project, built with Claude Code

Shipped with an AI coding agent under a gated agreement: plan, approve, test, commit

• Designed and built this interactive terminal in Next.js, React and TypeScript, with Claude Code as pair programmer and each change planned, reviewed and checked before commit.
• Each change is checked with formatting, linting, type checks, unit tests and Playwright end-to-end tests with axe accessibility checks; GitHub Actions also fails a run if Lighthouse accessibility or best practices scores drop.
• Audits its own dependencies with a real npm audit at build time, and answers curl with a plain-text card through a Next.js proxy while the page stays static.
• Evaluated each AI tool on evidence and wrote up the verdicts, the dead ends and a minimal setup for AI-assisted work on sensitive, regulated code.

stack: Next.js, React, TypeScript, Tailwind CSS, Vitest, Playwright, GitHub Actions, Vercel, Claude Code