Emanuele Pugliese

Profile

Payments architect, fifteen-plus years of event-driven architecture in high-assurance payments — digital wallets, EMV tokenisation and card issuing. Apple Pay, Google Pay and Samsung Pay on one tokenisation platform: TSM and HSM personalisation to Secure Element and HCE devices, EMV 3-D Secure and PSD2 strong customer authentication, delivered under PCI DSS and RBI India data localisation, on Java and Spring Boot microservices with Kafka, Kubernetes and OpenShift — Discover from 2016, then Capital One until the engagement concluded on 31 August 2026. Now full-time at Puglieseweb LTD, where a serverless AWS estate of 100-plus CloudFormation stacks and about 300 Lambda functions runs under 100 written architecture decisions, a measured cost per unit, and the rule that nothing reaches production by hand.

Core skills

Digital wallets & payment tokenisation

EMV payment tokenisation on six wallet programmes — Apple Pay, Google Pay, Samsung Pay, Garmin Pay, PayZapp and Amazon One — each a token requestor with its own certification, provisioning and lifecycle flows against the same issuer core; SRC wallets designed and implemented supporting EMV payment tokenisation; token provisioning and repersonalisation; transit and offline payments.

Card issuing, personalisation & provisioning

Card-issuing infrastructure for global financial services; issuing payment credentials and personalisation data through TSM and HSM to Secure Element and HCE mobile devices; deterministic provisioning IDs, card personalisation, high-volume provisioning; real-time payments and ISO message flows; wallet platform modernisation, TSM decommissioning and legacy-to-modern service migration.

Payment authentication, security standards & compliance

EMV 3-D Secure (ProtectBuy), PSD2 Strong Customer Authentication, PCI DSS, RBI India data localisation, GDPR, OWASP Top 10; written position statements on RBI India data-localisation requirements that directly shaped programme risk decisions and delivery direction.

Java & Spring

Java 21 in recent work, Java 8 earlier; Spring Boot, Spring Cloud, Spring Batch, Spring Integration, Spring MVC, Spring Security, Hibernate; REST microservices and REST API design (RFC 7807 problem details); SOAP and REST web services (JAX-WS top-down, Jersey), JMS, EJB3, Glassfish, WebLogic, OSB; TDD and BDD.

Event-driven architecture, streaming & integration

Event-driven and microservice architecture; Apache Kafka and Confluent, Kafka Streams, RabbitMQ, pub/sub libraries; Apache Storm, Spark and Spark Streaming topologies, HBase, Hadoop-cluster applications, data-ingestion flows; AWS EventBridge and SQS; event-driven systems supporting high-volume payment provisioning.

Architecture practice

Reference architecture for multi-country engineering teams; domain modelling and payment-domain taxonomy; wallet platform convergence, legacy-to-platform data migration and legacy-to-modern service migration; architecture decision records; high-level designs and implementation diagrams; multi-tenant SaaS — tenancy decided in the authoriser, per-tenant limits, product isolation; fitness functions in CI.

Cloud platforms, containers & data

AWS — Lambda (Python 3.11, arm64), API Gateway, DynamoDB (single-table design, vector indexes), S3 and CloudFront, Cognito, EventBridge, SQS, SES, KMS, WAF, Route 53 with DNSSEC, CloudFormation and SAM, Organizations and Control Tower; Kubernetes, OpenShift, Docker / Podman, Pivotal Cloud Foundry; Oracle, PostgreSQL. AWS Certified Solutions Architect – Associate.

Security engineering & cloud governance

OWASP Top 10; least-privilege IAM with permissions boundaries; detective baselines — AWS Config, GuardDuty, Security Hub (Foundational Security Best Practices), IAM Access Analyzer; account boundaries and per-product isolation; customer-managed keys (KMS) and WAF; GDPR by design — erasure sagas, WORM audit trail, post-erasure verification.

Delivery & ways of working

GitHub Actions release lanes with OIDC, build once and promote by SHA, Playwright end-to-end gates, organisation rulesets, Turborepo and pnpm monorepos; earlier Jenkins CI/CD pipelines for Pivotal Cloud Foundry deployments and Hadoop-cluster applications, Bamboo, and SAFe on multi-country programmes; Scrum Master, pair programming, technical-debt management, release planning and mentoring.

AI on AWS and front end

Amazon Bedrock (Claude, Titan embeddings) through an EU-only inference profile, retrieval-augmented assistants over crawled content, vector search, prompt and token cost engineering, metering and admission control; AI-assisted delivery with Claude Code under written guardrails. React 19, TypeScript, Astro, Tailwind CSS; accessibility checked against WCAG.

Selected work

Most recent first. Every figure is measured, not estimated.

1. Founder and Principal Consultant — one AWS platform, one delivery lane, 53 repositories

   September 2026 – present, full-time (the products below were built during 2026 alongside the Capital One engagement)

   Puglieseweb LTD

   One AWS Organization under Control Tower; every workload serverless in London (eu-west-2); shared identity, metering, content and conversation planes that every product plugs into; and one delivery lane that every change, in every repository, goes through. The platform carries the company's own SaaS products, including a multi-tenant AI assistant on Amazon Bedrock.

   • Runs a production estate with no private network at all — zero NAT gateways, zero VPC endpoints — across 106 CloudFormation stacks, 302 Lambda functions, 61 DynamoDB tables and 25 CloudFront distributions, with a preprod that mirrors it in its own AWS account (51 stacks, 174 functions).
   • Put the organisation's 53 active repositories on one release model — feature pull requests into an integration branch, a gated release pull request into main, merge commits only — enforced by an organisation ruleset and a required check rather than by convention, rolled out by script in a single day. Preprod packages every artefact under its commit SHA and production deploys the same bytes after the end-to-end suite has passed on the release, with an append-only ledger of every promotion and rollback.
   • Measured the organisation's GitHub Actions bill job by job — 24,976 minutes in September, 64% from one repository — found that 37% of a day went on re-running checks on the release pull request and 10% on duplicate scans, and redesigned the lane so checks run once per batch and the end-to-end suite once per release rather than on every push.
   • Security by pipeline: AWS Config, GuardDuty with S3 and Lambda protection, Security Hub on the Foundational Security Best Practices standard, IAM Access Analyzer and findings routed to a person, applied to every account of the organisation by one workflow that re-asserts them weekly. Deploys go through OIDC only, with per-repository roles trusted from a named GitHub environment and IAM stacks applied by a role that can touch nothing else.
   • Cost as a design input: a lint that fails a pull request on a never-expiring log group, a VPC-attached function or provisioned concurrency; Cost Anomaly Detection and hourly, resource-level cost exports deployed as code; and a September audit that traced a doubled bill to an expired credit, removed $55.51 a month of undocumented and idle resources (a duplicate CloudTrail trail alone was $47.94) and retired four product lines to shrink the blast radius.
   • Decided and began the move of production out of the AWS management account — one account per product, vended and bootstrapped by workflow, the region a parameter of every deploy — after rehearsing the same move for preprod in two days and turning each of its eight first-run traps into a fix in the shared pipeline.
   • One identity plane for every product: a single Cognito pool with 13 app clients, a Lambda authoriser on every route that decides tenancy and entitlements, per-tenant consumption limits enforced in the request path, and a product-isolation standard — own repository, own OIDC role, own stacks and data; events between products, never a shared table — checked by CI.
   • Unit economics measured, not assumed: £0.023 a reply, derived from the metering ledger and, independently, bottom-up from billed tokens — the two agree within 3% and reconcile exactly with the invoice — replacing the £0.0022 the plans had been priced on.
   • Plan ceilings derived from price at a 70% target gross margin and enforced synchronously in the request path, with an estate-wide ceiling (£250 a month, £25 a day) checked last and alarmed at 70% of itself: the pre-authorised worst case of ten top-tier tenants fell from £2,500 to £747 a month.
   • Retrieval over crawled pages with vector search native to DynamoDB, which removed the $175-a-month OpenSearch floor the previous design carried, and Claude on Amazon Bedrock through an EU-only inference profile, so customer data never leaves the EU.
   • AWS Organizations & Control Tower
   • CloudFormation / SAM
   • Lambda
   • API Gateway
   • DynamoDB
   • Cognito
   • EventBridge
   • CloudFront
   • KMS
   • WAF
   • Amazon Bedrock
   • GitHub Actions + OIDC
   • Playwright
   • Python 3.11
   • TypeScript

2. Digital wallet and tokenisation platform — Solution SME, then Principal Application Architect, then Payments / Application Architect

   2020 – August 2026

   Discover → Capital One

   The issuer's digital wallet and tokenisation platform behind Apple Pay, Garmin Pay, PayZapp, Amazon One, Google Pay and Samsung Pay — EMV tokenisation, PSD2 strong customer authentication and transit / offline payments — architected across multi-country teams as Solution SME (from January 2020), Principal Application Architect (from January 2022) and Payments / Application Architect at Capital One (from May 2025). Engagement concluded 31 August 2026.

   • Six wallet programmes on one tokenisation platform — Apple Pay, Google Pay, Samsung Pay, Garmin Pay, PayZapp and Amazon One — each a token requestor with its own certification, provisioning and lifecycle flows against the same issuer core.
   • Reference architecture for multi-country engineering teams on a platform where a design error is a regulatory event: EMV tokenisation, PSD2 strong customer authentication, transit and offline payments.
   • Lead architecture for the digital wallet platform, defining tokenisation and personalisation flows for Secure Element- and HCE-enabled devices.
   • Designed modern solutions for issuing payment credentials and personalisation data (TSM, HSM) to Secure Element and HCE mobile devices, and owned end-to-end architecture for digital wallet tokenisation and device-level payment integration.
   • Designed and implemented digital wallets (SRC, Apple Pay, Google Pay) supporting EMV payment tokenisation, and built authentication flows including ProtectBuy, Discover's EMV 3-D Secure implementation.
   • Delivered Google Pay and Samsung Pay token repersonalisation to production, enabling PSD2 Strong Customer Authentication and transit / offline payment use cases.
   • Event-driven services on Kafka / Confluent, Kubernetes and OpenShift with Spring Boot, on AWS, supporting high-volume payment provisioning.
   • Drove the convergence programme and payment-domain taxonomy work to unify wallet platforms following the Capital One / Discover integration.
   • Authored position statements on RBI India data-localisation requirements that directly shaped programme risk decisions and delivery direction.
   • Led wallet platform modernisation, including TSM decommissioning and legacy-to-modern service migration.
   • EMV Tokenisation
   • TSM
   • HSM
   • Secure Element & HCE provisioning
   • EMV 3-D Secure
   • PSD2 SCA
   • PCI DSS
   • AWS
   • Kafka / Confluent
   • Kubernetes
   • OpenShift
   • Docker / Podman
   • Spring Boot

3. Tech Lead — critical payment solutions

   July 2017 – January 2020

   Discover Financial Services

   Partnered with Architecture to shape software solutions and produced high-level designs and implementation diagrams. Coordinated delivery across developers and planned releases for critical payment solutions. Mentored engineers and promoted Agile practices including pair programming and technical-debt management.

   • High-level design
   • Release planning
   • Mentoring
   • Agile / pair programming
   • Technical-debt management

4. Senior Associate Java Developer — greenfield real-time payments platform

   April 2016 – July 2017

   Discover Financial Services

   Core engineer on a greenfield real-time payment system with event-driven streaming and microservice architecture, built with Spring Boot / Cloud, Kafka, Storm, Spark and HBase under SAFe. Implemented REST microservices, pub/sub libraries (Kafka, RabbitMQ), data-ingestion flows and real-time streaming topologies; built Jenkins CI/CD pipelines for Pivotal Cloud Foundry deployments and Hadoop-cluster applications; led legacy-to-platform data migration.

   • Spring Boot / Cloud
   • Kafka
   • RabbitMQ
   • Storm
   • Spark
   • HBase
   • Hadoop
   • PCF
   • Jenkins CI/CD
   • SAFe

5. Portal Software Engineer & Scrum Master

   April 2015 – March 2016

   Virgin Media

   Spring development and Scrum Master delivering portal solutions.

   • Java 8
   • Spring MVC / Security
   • Hibernate
   • BDD
   • Scrum

6. Middleware SOA Software Engineer

   December 2013 – April 2015

   Virgin Media

   SOAP and REST web services (JAX-WS top-down, Jersey), JMS and EJB3 against Oracle, with TDD and BDD on Glassfish, WebLogic and OSB.

   • JAX-WS
   • Jersey
   • JMS
   • EJB3
   • Oracle
   • TDD / BDD
   • Glassfish
   • WebLogic
   • OSB

7. Java Consultant

   December 2011 – December 2013

   FDM Group (client: Virgin Media)

   Consultant Java software engineer following FDM graduate training.

   • Java
   • Oracle
   • Unix
   • Agile

8. Monitoring portal and e-commerce

   2007 – 2008

   Motorola · MG Eco Engineering

   Internal real-time device monitoring portal with a multi-threaded socket engine for live data ingestion (PHP, Bash, Perl), and ASP.NET e-commerce development.

   • PHP
   • Multi-threaded Sockets
   • Bash
   • Perl
   • Linux
   • ASP.NET

Ways of working

Decisions are written down

Every significant choice is an architecture decision record — context, the alternatives rejected, an execution table — and there are 100 of them. A record is amended, never rewritten. Every merge is reconciled against the documents it touches, and a hook, a CI check and a weekly audit enforce that, not memory. On the payments platform the written artefacts were high-level designs and implementation diagrams produced with the architecture function, and position statements on RBI India data-localisation requirements that directly shaped programme risk decisions and delivery direction.

Nothing reaches production by hand

At Puglieseweb LTD: GitHub Actions with OIDC roles scoped to one repository and one environment; no long-lived credentials, no console changes, no hand-applied stacks. A step a person still performs is listed as a defect with a deadline. The company's 53 active repositories run on one release model, enforced by an organisation ruleset and a required check rather than by convention, against a preprod that mirrors production in its own AWS account; every artefact is packaged under its commit SHA and production deploys the same bytes after the end-to-end suite has passed, with an append-only ledger of every promotion and rollback. Automation is not new here: Jenkins CI/CD pipelines for Pivotal Cloud Foundry deployments and Hadoop-cluster applications were built on a greenfield real-time payments platform, and the Tech Lead years were spent coordinating delivery across developers and planning releases for critical payment solutions.

A design target is a number

A constraint that has not been given a number is not being designed for. Unit cost is derived from the bill by two independent methods — £0.023 a reply, from the metering ledger and, independently, bottom-up from billed tokens; the two agree within 3% and reconcile exactly with the invoice, and they replaced the £0.0022 the plans had been priced on. Ceilings then derive from price at a 70% target gross margin and are enforced synchronously in the request path, with an estate-wide ceiling (£250 a month, £25 a day) checked last and alarmed at 70% of itself: the pre-authorised worst case of ten top-tier tenants fell from £2,500 to £747 a month. A lint refuses the expensive shape before it ships and anomaly detection watches for what the lint cannot see. Delivery is read the same way: 24,976 GitHub Actions minutes in September, measured job by job, showed 37% of a day going on re-running checks on the release pull request, and the lane was redesigned around the finding.

Regulation is a design input, not a review gate

Fifteen-plus years on payment platforms where a design error is a regulatory event: EMV tokenisation, PSD2 strong customer authentication, EMV 3-D Secure, and delivery under PCI DSS and regional regulation including RBI India data localisation, across multi-country teams. The same constraints are now enforced where the system runs: GDPR by design (erasure sagas, a WORM audit trail, post-erasure verification), customer-managed keys, data kept in the UK and EU regions named to the customer, AI inference through an EU-only endpoint, and account boundaries with per-product isolation — own repository, own OIDC role, own stacks and data; events between products, never a shared table — checked by CI. Detective controls (AWS Config, GuardDuty, Security Hub, Access Analyzer) are applied and re-asserted weekly by the same pipeline that deploys, with findings routed to a person.

Migration is the expensive part, so it is designed for

Continuous refactoring and migration is the most expensive thing an estate does, in money and in calendar time, and it is the work most often left to chance. Wallet platform modernisation and TSM decommissioning; legacy-to-modern service migration; legacy-to-platform data migration; a convergence programme and a payment-domain taxonomy that unified two wallet platforms after a merger. The rule is the same every time: migrate by pipeline, rehearse it somewhere that does not matter — the preprod rehearsal took two days and turned eight first-run traps into fixes in the shared pipeline — and keep the route back.

About Puglieseweb LTD

Puglieseweb LTD is a UK software company in Hook, Hampshire. It consults for engineering leaders and regulated industries, and it sells its own products — Ema Answers to businesses, SystemDox to software teams and Ema Comfort to installers — all on the same AWS platform, run by the same pipeline, and priced from measured cost.