Russell White

My team built this platform and now runs it. It tracks philanthropic funding for Community Reinvestment Act reporting, and it replaced spreadsheets and manual reconciliation across twelve source systems. The pipelines were never the hard part. Twelve systems carried twelve definitions of the same things, each reasonable to the team that built it, and regulated reporting gives you nowhere to hide that. Agreeing a single model, then holding it steady while everyone moved onto it, was the actual work. The reporting cycle went from weeks to days.

It runs as containerized services on AWS: Java and Spring Boot behind a React front end, with PostgreSQL as the system of record and object storage underneath. Only changes move to the analytical side, so it stays current without recopying history, and that side is a managed lakehouse the business can query directly instead of queueing a request with engineering. Keeping the operational path separate from the analytical one is what lets reporting move quickly without putting regulated data at risk.

We run chaos testing against it. In a regulated environment the interesting question is never whether the system works, it is what it does when a dependency does not. Vulnerability remediation runs on the same principle: critical and high findings have defined remediation windows and are closed against that clock.