Open to remote roles and freelance projects

Sam Badiei · Systems Engineer & Software Developer — I keep businesses’ IT running — and build the software they rely on.

Working fully remotely for a Belgian IT managed-service provider since November 2023, supporting 100+ client organisations: Microsoft 365, Active Directory, Windows Server, networking and security on one side, production software in PHP, Node.js/TypeScript and React on the other.

Get in touch

Sam Badiei

Systems Engineer & Software Developer

Location: Istanbul, Türkiye
Time zone: UTC+3 · 1–2 h ahead of Central European time
Working language: English

Code & packages

tickets and projects completed (95%): 2,200+
client organisations supported: 100+
Microsoft 365 tenants with MFA enforced: 25+
mail migrations to Microsoft 365: 8+
development worklogs: 500+
client organisations with custom apps: 10+

About

Two skill sets, one engineer

I’m a systems engineer and software developer. Since November 2023 I’ve worked fully remotely for BIT Computers, a Belgian IT managed-service provider, as the day-to-day engineer for more than 100 client organisations — law and accountancy firms, schools, manufacturers, healthcare practices and non-profits.

On the systems side I work across Microsoft 365 and Exchange, Active Directory and Group Policy, Windows Server and RDS, pfSense networking, 3CX telephony, backup and endpoint security. On the development side I build and run production software in PHP/MySQL and Node.js/TypeScript/React, from a multi-account WhatsApp support platform to Peppol e-invoicing and payment integrations.

Doing both means I automate what I support, and I think about how code is deployed, monitored and supported — not only how it’s written. I look for root causes, make changes carefully and document as I go: more than 3,800 worklog entries so far.

“Very helpful, patient and willing.”

Feedback relayed from a school I support

At a glance

Based in: Istanbul, Türkiye (UTC+3)
Experience: Belgian MSP since Nov 2023
Work style: Fully remote, in English
Education: B.Sc. Software Engineering

Experience

Where I’ve worked

A combined systems-engineering and development role at a Belgian managed-service provider, delivered fully remotely.

Systems Engineer & Software Developer
BIT ComputersIT managed-service provider (MSP), BelgiumFully remote
Nov 2023 – Present
Day-to-day engineer for 100+ client organisations and developer on the company’s in-house PHP/MySQL ERP and client applications, working remotely (ISL Online, VPN, RDP) and often directly with client owners and managers.
Systems & infrastructure
- Microsoft 365 migrations: Carried out 8+ mail migrations from on-premises Exchange 2010, hosted Exchange and IMAP/Gmail. One covered five domains, with a 130-record DNS cutover plan, SPF/DKIM/DMARC on every domain and website mail sent through SMTP AUTH and an Entra app registration.
- File-server migration: Moved a school’s Windows Server 2008 DFS file servers to Server 2025: 449,096 files (318 GB) with NTFS permissions intact and zero copy failures, all 33 GPO and script path references repointed, and DFS retired.
- Security: Enforced MFA on every account across 25+ client Microsoft 365 tenants, most in a four-week 2025 campaign. Deployed EDR (SentinelOne, Palo Alto Cortex XDR) at 12 client organisations, mostly through Group Policy, and handled email-account compromises at four clients.
- Networking & telephony: Deployed 7 pfSense firewall/VPN gateways with AD-backed OpenVPN, built VLAN segmentation for a hotel and an event company, and upgraded 10 client 3CX systems from v18 to v20.
- Operations: Onboarded 100+ and offboarded 60+ users across 20+ organisations, prepared 100+ Windows PCs and laptops, handled 115 monitoring-alert tickets across 21 clients and kept backups monitored for 15+ clients.
Software development
- WhatsApp support platform: Designed and built the company’s multi-account platform on Node.js/TypeScript, whatsapp-web.js (Puppeteer), Express, Prisma/MySQL and a React 19/Redux front end with real-time updates over Socket.IO.
- Peppol e-invoicing: Implemented UBL/BIS 3.0 e-invoicing in the in-house ERP ahead of Belgium’s 2026 B2B mandate, including an access-point API client for sending, receiving, webhooks, legal-entity registration and directory lookup.
- Payments: Integrated Mollie payments, refunds, payment links and webhooks with a settlement breakdown for bookkeeping; after fixing pagination handling, all 246 settlements load in about one second.
- Client applications & tools: Main developer of a field-service app for an industrial manufacturer’s Benelux subsidiary, plus ERP modules, GPS geofencing and a Node.js switch-inventory agent rolled out to 15+ client networks.
Web Developer Intern
Pars Oil and Gas CompanyEnergy company, IranBushehr, Iran
Mar 2022 – May 2022
Designed, developed and maintained the company website, an events-and-calendar web app, an e-shop and internal tools.

Selected work

Projects I’ve built

Client names are left out on purpose: work projects are described by sector, with numbers from my own work logs. Personal projects are things I build in my own time.

In-house platform

Multi-account WhatsApp support platform

Designed and built the company’s multi-account WhatsApp platform, which replaced a paid third-party API.

Node.js/TypeScript backend on whatsapp-web.js (Puppeteer) with an Express control server and self-restarting worker threads
Prisma/MySQL queue with locking to prevent duplicate sends
React 19/Redux front end with real-time updates over Socket.IO, linking chats to tickets
TypeScript strict mode, ESLint, Pino structured logging and unit tests; an AI-assisted review surfaced about 50 issues, of which I fixed and tested 35+
Traced group-creation failures to WhatsApp’s LID privacy change and shipped a workaround without waiting for an upstream fix

Node.js
TypeScript
Puppeteer
Express
Prisma
MySQL
React
Redux Toolkit
Socket.IO

In-house ERP

Peppol e-invoicing

Implemented UBL/BIS 3.0 e-invoicing in the company’s ERP ahead of Belgium’s 2026 B2B e-invoicing mandate.

Validator-clean Belgian UBL/BIS 3.0 invoice templates
Access-point API client for sending and receiving, webhooks, legal-entity registration and directory lookup
Webhooks stored before they are acknowledged
OAuth tokens reused to stay within strict API rate limits; bulk registration of customers

PHP
MySQL
UBL / XML
REST
OAuth2
Webhooks

Holiday-rental business

Payments & finance automation

Integrated Mollie payments, refunds, payment links and webhooks, with a settlement breakdown that feeds bookkeeping.

246

settlements load in about a second

Per-method fees and rolling reserves calculated per settlement and verified against every settlement
Traced later sync failures to pagination handling; after the fix, all 246 settlements load in about one second
Card-terminal payout reconciliation: a job every 40 minutes parses the provider’s PDF reports and checks that each report’s lines add up to its total

PHP
MySQL
Mollie API
Webhooks
Cron

Industrial manufacturer · Benelux subsidiary

Field-service management app

Main developer of the technician planning and intervention app, working with the client’s technical manager and planning back office.

DayPilot technician planner with vehicle assignment
HTML5-canvas e-signatures embedded in intervention PDFs
Headless-Chrome PDF service (Browsershot/Puppeteer, evaluated against Playwright)
AJAX time registration and SAP CSV imports
Migration path from a legacy Java calculator (XML-to-JSON parser, field-mapping import) and a token-authenticated daily Bash-to-PHP sync

PHP
JavaScript
MySQL
DayPilot
HTML5 Canvas
Puppeteer
Bash

Client networks

Switch-inventory agent

A Node.js agent that collects switch ports, MAC addresses and LLDP neighbour data and uploads it to the ERP to map network topology.

15+

client networks

Compiled to a standalone .exe and run as a scheduled task
Telnet fallback that parses LLDP neighbour output for switches that don’t expose it over SNMP
Rolled out to 15+ client networks

Node.js
SNMP
LLDP
Telnet
JSON

Also built

Traccar GPS geofencing and stop analytics for a roofing contractor’s fleet
ERP modules for an agri-food group: document and photo library with QR upload, time-clock and HR-API sync
Reusable ERP UI components from Figma designs and a PDF.js document wizard
Browser-based classroom screen-monitoring tool (UltraVNC/noVNC WebSocket bridge)
Combell DNS API client and UniFi controller sync

Built after a client’s business email compromise

AI-assisted Microsoft 365 security monitor

PowerShell collectors export each monitored tenant’s inbox rules and Entra sign-in logs for scheduled LLM analysis.

client tenants monitored

Certificate-based app authentication for the collectors
Staff remove or whitelist flagged mail rules in one click from the ERP
High and critical findings raise monitoring alerts
Validated with a controlled test sign-in from an unfamiliar IP address; core pipeline working within about a week

PowerShell
Exchange Online
Entra ID
LLM (Claude)
PA Server Monitor

SMEs and non-profits

Microsoft 365 migrations

Carried out 8+ mail migrations to Microsoft 365 from on-premises Exchange 2010, hosted Exchange and IMAP/Gmail.

migrations

A five-domain migration with a 130-record DNS cutover plan and TTLs lowered in advance
SPF/DKIM/DMARC on every domain; website mail sent through SMTP AUTH and an Entra app registration
For a non-profit: took over a shadow tenant to reclaim the domain, built a new Server 2019 domain controller and deployed Entra Cloud Sync
A Gmail/IMAP move of 24,880 items (20.3 GB)

Exchange Online
Exchange Server
Entra ID
Entra Cloud Sync
DNS
PowerShell

Secondary school

School file-server migration

Moved Windows Server 2008 DFS file servers to a new Server 2025 file server with zero copy failures.

449,096

files moved, zero failures

449,096 files (318 GB) copied with NTFS permissions intact
Rescued 439 files that existed only on one server and recreated 12 shares
Repointed all 33 GPO and script path references, then retired DFS

Windows Server 2025
DFS
robocopy
Group Policy

25+ Microsoft 365 tenants

Security rollout across client tenants

Enforced MFA on every account across 25+ client tenants, most of them in a four-week 2025 campaign.

25+

tenants with MFA enforced

EDR at 12 client organisations (SentinelOne at 11; Palo Alto Cortex XDR at one, as its parent group required), mostly through Group Policy
Handled email-account compromises at four clients: unified-audit-log forensics, inbox-rule sweeps, OAuth-grant revocation and outbound mail limits
Standardised administrator access in 13 managed tenants
DKIM and/or DMARC set up on 15+ client domains

Entra ID
MFA
SentinelOne
Cortex XDR
Group Policy
PowerShell

SMEs, a hotel and an event company

Networking, firewalls & telephony

Deployed 7 pfSense firewall/VPN gateways, mostly as XenServer VMs replacing end-of-life Cisco routers.

pfSense gateways deployed

AD-backed OpenVPN, and staff moved off a blocked PPTP VPN
Per-room VLANs and UniFi PPSK Wi-Fi at a hotel
Server and guest VLANs across four switches at an event company
10 client 3CX phone systems upgraded from v18 to v20 using a backup, snapshot and restore procedure

pfSense
OpenVPN
VLANs
UniFi
XenServer
3CX

Many client domains

Group Policy & PowerShell automation

Replaced repeated per-PC fixes with Group Policy and PowerShell.

client domains in under a week

An RDP-warning fix rolled out to 12 client domains in under a week
Scheduled PuTTY/WinSCP vulnerability remediation and printer deployment targeted by security group
Deployed and customised scheduled clean-up of inactive AD accounts at 4 clients
NetSupport School 15 rolled out through Intune with 99% success (398/402 student devices)

Group Policy
PowerShell
Active Directory
Intune

Personal project · in progress

NancyUI: a custom desktop layer for Windows 11

Designed and built a layer that runs on top of Windows 11, adding a Win-key app launcher, a dock, desktop widgets and themes that restyle both the layout and the Windows look.

Win-key launcher with fuzzy search and usage-based ranking, driven by a low-level keyboard hook that keeps every Win+key shortcut working and steps aside for games and remote desktop
Dock with running and pinned apps that can hide the Windows taskbar, plus desktop widgets (clock, CPU, memory, media controls) that pause when the desktop is covered
JSON theme engine (tokens, styles, layouts) with schemas and hot reload; themes can switch dark/light mode, accent colour and wallpaper, with a backup and one-click restore
About 44,000 lines of Rust in 8 crates, covered by 561 automated tests
Built with AI coding agents (Claude Code), which I directed, reviewed and tested

Rust
Tauri 2
Svelte 5
TypeScript
Win32 / WinRT
WebView2

Personal project · prototype

ComfyClaw: visual scripting for TypeScript workflows

Built a browser-based visual programming editor where typed nodes are wired into programs, with a Node.js runtime that runs graphs as background services.

About 60 node types (text, arrays, objects, HTTP, conditions, loops, regex, dates, variables) and reusable subflows on a React Flow canvas
Graphs run in the browser or headless in Node.js, triggered by HTTP, webhooks or cron schedules (own cron parser with time zones)
Installs npm packages and turns their functions into typed nodes by reading their type definitions with the TypeScript compiler API
Graph migrations, a deterministic run mode and an 88-scenario example library with an automated checker in CI
Built with AI coding agents (Claude Code), which I directed, reviewed and tested

TypeScript
React
React Flow
Zustand
Vite
Node.js
TypeScript Compiler API

Personal project · desktop, server and Android

Self-hosted private messenger

Built a private one-to-one messenger: an Electron desktop app (2025), later extended with a self-hosted server, an Android app and a custom end-to-end encryption design.

Desktop app with text, images, video, files, voice notes, GIFs, replies, search, themes, auto-update and WebRTC voice calls
Self-hosted Node.js/Socket.IO relay that deletes each message once it is delivered, with email sign-up, 2FA and per-device sessions
Expo/React Native Android app on the same written protocol
Custom end-to-end encryption design (per-device sealed envelopes, signed device lists, safety numbers, encrypted attachments), checked against 278 test vectors in CI
The 2026 server, Android app and encryption were built with AI coding agents (Claude Code), which I directed, reviewed and tested; the 2025 desktop app is hand-written

Electron
React
TypeScript
Node.js
Socket.IO
WebRTC
Prisma
MySQL
React Native
Expo

Personal project · self-hosted web app

Sam’s Authenticator: self-hosted 2FA vault

Built a self-hosted vault that keeps an organisation’s 2FA secrets on its own server, so authorised admins can get codes for shared company accounts without relying on one person’s phone.

Secrets encrypted with AES-256-GCM under envelope encryption that is unlocked into memory at start-up
Tamper-evident audit log (each entry hashed with the previous one) and multi-tenant roles enforced in one central module
Sign-in with password plus emailed code or with passkeys (WebAuthn); QR and Google Authenticator import; English, French and Dutch
511 automated tests, CI and a one-command Ubuntu install with Caddy HTTPS
Built with AI coding agents (Claude Code), which I directed, reviewed and tested

Next.js
TypeScript
Prisma
MySQL
WebAuthn
Caddy
Ubuntu

Personal project · Windows tool

Screen Translator

Built a Windows tray app that translates any text on screen: select a region with a hotkey and the translation appears as an overlay on top of the original text.

Local OCR (EasyOCR, on the GPU when available); only the extracted text is sent to the chosen AI provider: Gemini, OpenAI or Ollama
Two requests in parallel: a quick popup first, then translations placed at their original screen positions without overlapping
Settings, hotkey and provider changes apply instantly; packaged as a single Windows executable
Built with AI coding agents (Claude Code), which I directed, reviewed and tested

Python
Tkinter
EasyOCR
Gemini API
OpenAI API
Ollama
PyInstaller

Personal project · web app

Deify Secret: one-time secret links

Built a web app for sharing secrets through links that can be opened once and then expire.

Messages encrypted with AES-256-GCM using a per-message key that lives in the link and is never stored
Race-safe one-time reveal in a single database update; revealing takes a click, so link-preview bots can’t use up the secret
Accounts with a history of sent links, push alerts when a secret is read (ntfy), an admin statistics chart, and English, French and Dutch

Next.js
React
TypeScript
Prisma
PostgreSQL
Clerk
Chakra UI

Personal project · Linux server

Self-hosted server and admin panel

Built and ran my own Linux web server with a PHP/MySQL admin panel that generates editing screens for any database table from the database’s own structure.

One generic grid, form and filter engine for every table, configured through settings tables, with foreign-key pickers read from the database schema
Server dashboard listing cron jobs and systemd services, with a job queue run by a background script
Hosted my other services: the messenger’s real-time backend (Socket.IO), a live price watcher with email alerts and a restaurant menu API
Apache with SSL, scheduled MySQL backups and automatic off-site backups to Git

PHP
MySQL
JavaScript
Node.js
Socket.IO
Apache
Linux
cron
systemd

Skills

What I work with

From Microsoft 365 tenants and domain controllers to TypeScript services and API integrations.

Microsoft 365 & identity

Tenants, mail, identity and email security

Exchange Online
Exchange Server 2010–2019
Entra ID / Azure AD
MFA
Entra Cloud Sync
Intune
Teams
SPF / DKIM / DMARC
CSP licensing

Windows & infrastructure

Servers, directory services and virtualisation

Active Directory
Group Policy (GPP, ADMX)
Windows Server 2008–2025
RDS / terminal servers
DFS
DNS / DHCP
XenServer / XCP-ng
Xen Orchestra

Networking & security

Firewalls, VPN, segmentation and endpoint protection

pfSense
OpenVPN (LDAP)
VLANs
UniFi (PPSK)
SentinelOne
Palo Alto Cortex XDR
Incident response

Backup, telephony & monitoring

Keeping services recoverable and observable

Synology Hyper Backup
Active Backup for Business
3CX v20
Yealink
Wireshark
PA Server Monitor
ISL Online

Programming languages

Used in production

PHP
JavaScript
TypeScript
SQL (MySQL, T-SQL)
PowerShell
Python
Bash

Frameworks & tools

Back end, front end and tooling

Node.js
Express
React
Redux Toolkit
Vite
Prisma
Socket.IO
Puppeteer
Bootstrap
PDF.js
Postman
Git / GitHub

Integrations

APIs, protocols and third-party services

REST APIs
Webhooks
OAuth2
HMAC
WhatsApp (whatsapp-web.js)
Peppol UBL/BIS 3.0
Mollie
Traccar GPS
SNMP / LLDP

AI tooling

Used in production, development and evaluation

LLM integration in production (Claude)
Claude Code (agents, MCP)
Local LLMs (Ollama, evaluated)

Open source

Code you can look at

My work code is private, so here are the packages and repositories I publish myself.

2025 · 1,500+ npm downloads

rgen-cli

Command-line tool that prepares React projects and scaffolds components, hooks, pages, layouts, routes, contexts, forms and stores, with optional Gemini AI integration.

TypeScript
oclif
Node.js

npm GitHub

2022 · 1,000+ npm downloads

modnarjs

Library that generates realistic fake data — names, dates, phone numbers, network data and lorem text — for tests and prototypes.

JavaScript
Node.js