Architecture · Engineering · AI platforms

JonahSullivan

Cloud-native Architect & Engineer

Over twenty years delivering software, specializing in product modernization, processes, and people. Focused on establishing optimal application architecture and engineering practices — and on mentoring, coaching, and supporting the teams who build and maintain the products vital to customers.

Duck Creek
ThatsNinja
Veracode
Capital One
Experian

A polemic

AI safety is an engineering problem.

The framing debate is stale. AI safety is not a philosophical question awaiting an answer — it is an engineering discipline, and one with decades of safety-critical precedent. Aviation, nuclear power, and distributed systems all build safety under uncertainty. None of them solved it; all of them manage it, continuously, through failure modes, margins, and monitoring. That is the frame worth working in.

Safety is not a property of the model alone, settled after training. It is a property of the system the model runs inside. Some controls are settled engineering — rate limits, human-in-the-loop approval gates, blast-radius containment, least privilege: reliability controls distributed systems has shipped for decades, and they work. Others are genuinely new: output classifiers and prompt-injection defenses exist only because this component exists. They are young, and adversarial pressure makes them an active arms race. Treating the second class as though it were the first is the present failure mode.

Control failures come from two directions. One is old: known controls get skipped when teams ship fast — write access without blast-radius thinking, irreversible operations without dry-runs. Circumspection remains the binding constraint, as it always has been. The other is new: the component is probabilistic and adversarially pressured, so semantic controls could not simply be borrowed from prior practice. And incentives run against both: per-token pricing pays for volume rather than utility, and training rewards pleasing over precision. The principles hold where incentives and attention align; engineering discipline plus honest incentive design is the path.

20+

Years delivering software

Faster static scans

90%

Lower scan cost

280m

Daily consumers monitored

02Experience

Selected roles.

Duck Creek Technologies
Sr. AI Engineer, Contingent
Feb 2026 — Present
- Built and tuned AI user-experience components: guardrails, skills and tool catalogs, model auto-routing, search-and-execute tooling surfaces, and auto-regressive and RSI pipelines supporting agentic intelligence.
- Helping realize a generative/deterministic workflow architecture based entirely on XState, harnessing models from Anthropic and OpenAI to a novel framework for problem-solving and rigid autonomous agent sandboxing.
- Spearheading architecture and engineering of the AI Platform initiative — combining model gateway, MCP gateway, cost observability, cost control, and IaC repeatability — targeting Azure.
ThatsNinja
Co-founder, Principal Consultant
Sep 2019 — Present
- AI-enabled systems architecture and engineering: creating agentic learning systems for customer service and other specific roles, and engineering MCP interfaces to existing APIs.
- Engineered Capital One's transition to an event-driven microservice/serverless architecture (Oct 2024–Apr 2025); integrated Discover infrastructure for debit processing.
- Provided digital-forward consulting for local SMBs, including full-stack development, UX research, and monetization strategies.
Veracode
Sr. Principal Engineer, Architecture
May 2021 — Apr 2024
- Led the Evolutionary Reference Architecture team, including five IC reports and a Lead Architect; created POC/POV and exemplar projects with corresponding documentation, and refined engineering standards and practices for Veracode's then-nascent vNext deployment and operations platform.
- Founded and led the Anchor Guild, comprising 21 Anchor engineers across Veracode. A regular Lean Coffee cadence socialized engineering at a layer unencumbered by middle-leadership.
- Re-engineered Veracode's core IP static scan process, realizing a 6× wall-clock performance improvement and a 90% reduction in scan cost per scan (97th percentile across scans).

03Selected work

Case work across platforms, pipelines, and compliance.

Dux

Duck Creek

Reimagining the application platform, build process, and deployment architecture — and creating platform Claw agents for distributed DevSecOps.

AI platform
XState
Azure
MCP
DevSecOps

Reimagining Duck Creek's application platform architecture, build process, and deployment architecture.
Creation of platform Claw agents for distributed DevSecOps via agent memory surfaces and search-and-execute tooling.

Static Scan Pipeline

Veracode

A greenfield, parallel implementation of Veracode's core IP: value-centric, event-driven, and reactive — engineered AWS-native.

DDD
EKS
Kafka
ArgoCD
Serverless

Architectural and engineering greenfield to create a parallel implementation of Veracode's core IP.
Domain-driven design, first principles first — converged on a value-centric, event-driven and reactive architecture.
Engineered AWS-native in EKS, with Confluent Kafka as the event bus.
Yielded architectural exemplars such as serverless and microservice project templates, and ArgoCD ApplicationSets.
Reduced Veracode's overall cost per scan by over 80% (90% reduction in compute cost).

IMARS Platform

Experian Consumer Services

Aggregating and acting on non-credit consumer identity and reputational signals across more than twenty data vendors.

Identity
Fraud
Serverless
OAuth
AWS

Aggregating and reporting on non-credit consumer identity and other data factors, detecting and acting upon fraud and reputational signals.
Monitored 280 million daily individual consumers across eleven vendor sources and multiple dimensions of personal data: non-credit payday loans, criminal records, violent and sex-offender registry searches with geo-proximity checks, and social media content flagged for bullying, self-harm, substance use, weapons, or depictions of sexuality or violence.
Integrations to 20+ distinct data vendors, including non-credit payday loan records, criminal records, civil public records, social media platforms, and consumer reporting agencies.
Integrations in PHP, Java, Python, Perl, Ruby, and Node.js.
Introduced AWS well-architected, serverless integrations to social media APIs via OAuth for aggregating user data for analysis.

CCCP

Experian

The California Consumer Compliance Platform — fan-out and monitoring of legally mandated requests about personal data handling.

Step Functions
ECS
DynamoDB
Datadog
Compliance

Created to fan out and monitor legally mandated requests from California residents regarding the handling of their personal data.
Pioneered the use of AWS Step Function state machines at enterprise in ECS.
Augmented existing CodeBuild and CodeDeploy pipelines to deploy via Experian's articulated deployment platform.
DynamoDB and ElastiCache Redis adapters for data and transient caches, with no consumer data traveling internal to the state machine.
Observability in Datadog, with full request lifecycle and alerting on SLA risk.

Current work products