Tor Loch
Senior Software Engineer · full stack · business applications and applied AI
Memphis, TN · on-site, hybrid or remote (US) · authorized to work in the US · torloch.com · linkedin.com/in/torloch
Summary
Senior Software Engineer with 20+ years of web and software development, building the applications a business runs on: a service floor's operations platform, a 22-brand .NET platform, analytics and applied AI. C#/.NET, PHP, SQL and TypeScript, with Docker, Azure and AWS with Terraform.
I own the work from the user's problem through the data model, the front end, the deploy and the support. Most often I have been the one developer the operation depended on, frequently inside a marketing team. I direct AI coding agents with written specs, task plans, tests and a separate reviewer, and the design decisions and the release stay mine. I started programming with tools that cut call times in call centers, and I still take things apart to see how they work.
Experience
Senior Software Engineer
Education company · 2026 – present
- Build and run an analytics platform in production, built to replace an estate of 822 legacy reports; the replacement is ongoing. Nightly data-refresh registry, metrics from web analytics and the email platform.
- Cut a measured production Email Performance request from 1.549 s to 0.064 s by replacing a repeated count over 5.26 million rows with a maintained summary; equal results on 220 of 220 date ranges in the September 29, 2026 release. Six more report pages went from 7–17 s to 0.4 s or less (0 differences in 461 checks); a customer profile's first load went from 97 s to 1.9 s.
- Browser recording studio that replaced a hosted service: live captions, approvals and time-zone bookings inside the company's platform. Release gate of 20 suites: 1,332 tests passed, 0 failed. In production: 46 tagged releases in its first 34 days, and a recovery drill that rebuilt it in 36 min 34 s against a 4-hour target.
- AWS infrastructure as code with Terraform (EC2, RDS, S3, CloudFront, Route 53, WAF, Lambda); CI/CD with GitHub Actions.
Senior Web Developer
National home-services company · 2022 – 2026
- The developer the company's marketing websites depended on: 22 brands and 24+ sites, with delegated Azure access to run them independently.
- Led 20+ migrations from WordPress and Kentico to Umbraco, with URL mapping, redirects and checks for titles, canonical URLs and structured data; a migration engine with seven converters, a dry run and a snapshot before each write.
- One shared .NET template for the brands, first released to the marketing group in November 2025: 16 reusable sections, design tokens from Figma, 57 location-brand records, a go-live switch per brand. With it, a brand migration went from months to days.
- Umbraco 13 to 17 and .NET 10 upgrade; legacy sites moved off third-party hosts into Azure; from December 2025, deployment from one repository to two hosted CMS projects, later with per-project locks, replay with no-op detection, logging and warm-up.
- Planned my own hand-off before leaving in April 2026: recruited replacement developers, moved design work to the creative team and email to a dedicated team; the template and designs remain in use. Assisted IT with security audits and took on Cloudflare DNS and HTTPS for 400+ domains.
- Connected AI agents to the CMS through its MCP server (330+ tools) on test and development tiers only, under a written playbook: audit first, save as draft, batches of 50, review between batches. Project manager with outside agencies on features and brand guidelines.
Service Operations Manager / Application Developer
Global hardware manufacturer · 2016 – 2022
- Extended the operations platform I had started in my first stint and updated its PHP stack; it grew into one PHP and MariaDB platform of 70+ tools with five back ends, used by technicians, QA and managers. Built the shop-floor imaging application: a unit configuration went from one an hour on hand-made USB drives to 12 to 24, dozens at once. By May 2022 its record counters set upper bounds of about 805,000 order status entries and 61,000 imaging sign-ins.
- Production tracking with order dashboards, status priorities, a work timer and serial histories; repair, RMA and corrective-action tracking; depot inventory, substitutions and end-of-life databases.
- Imaging and firmware: boot-environment imaging on the line, station setup that programs firmware identity from the mainboard, an image builder for Windows XP through Windows 10; VMware vSphere machines and snapshots to test imaging and firmware work before deployment.
- Labels, reporting and integrations: production, box and device labels as PDF; cross-department reporting; APIs against MySQL-family databases, SQL Server, Oracle, directory sign-in and mail; a WebSocket server for live dashboards.
- Project manager for site-wide processes and trainer on each new application. Back in 2016 after the agency years: 12 years with the manufacturer in all.
Digital Services Developer
Marketing agency · 2013 – 2016
- Customer-facing web for health plans and insurers: landing pages and lead funnels built from creative decks, forms wired to the marketing platform and CRM, tested against each client's browser matrix in BrowserStack.
- HTML email tested in Litmus against each client's inbox matrix and sent through Silverpop and Mailchimp; API integrations with client systems.
Level III Support Specialist / Application Developer
Global hardware manufacturer · 2007 – 2013
- Started the service operation's internal platform: the support knowledge base and imaging system.
- Ported legacy ASP.NET support tooling to PHP.
- Trainer for authorized service providers.
How I work
- Users first: I start at the bench or the desk where the software will be used, then write it down.
- Spec first: each feature starts as a written spec and a task plan, and a prototype when a constraint needs measuring.
- Review: a separate reviewer before release, a model from another vendor on big releases, and the release decision is mine.
- Tests and evals: never weaken a test to pass; models are chosen by an eval that runs their output.
- Guardrails: Semgrep and Gitleaks scan each file Claude Code writes; CI pipelines run their own checks. Secrets stay in a vault.
- Agents on live systems: MCP and skills on test and development tiers first, permissions set by the environment, a human check between batches.
- Agent memory: six agents share one git-backed knowledge vault of notes and lessons.
Other projects
- Text-to-SQL chat on local models (in progress): built the eval first (12 questions, hand-checked SQL, scored by running each query) and tested 14 models; the pick answered 11 of 12. The same eval showed the prompt was the bigger problem (5 of 12 through it, 9 of 12 neutral): removed a hidden date filter and swapped 139 fixed examples for retrieval of the 12 closest, cutting the prompt from about 22,000 to 9,700 tokens.
- Household budget app: a port from React and Node to PHP and htmx, checked against the original app during the migration. About 285 PHP test methods (September 25, 2026 count).
- Caps Lock window manager: Rust, for macOS, Windows and Linux. 811 Rust test functions (September 25, 2026 count).
- Media library automation kit: a shared seven-route service contract and an audiobook librarian built on it. About 133 tests.
- Voice-capture Android app: Kotlin and Jetpack Compose. 158 tests: 111 unit and 47 instrumented (September 25, 2026).
- Self-healing server estate: weekly updates that check service health and roll back failed updates.
- Voice hub for Claude Code: built on the Claude Agent SDK, with speaker identification by voiceprint and a smart-home fast path. 108 tests.
Skills
- Languages
- C# and .NET (ASP.NET, .NET 10) · PHP 8 · SQL (T-SQL) · TypeScript and JavaScript · Python · Rust · Kotlin · PowerShell · Bash
- Front end
- React, Lit and Svelte · htmx · Bootstrap · responsive web · Tauri desktop apps
- Data
- SQL Server · MariaDB and MySQL · Oracle · SQLite · Redis · query tuning · text-to-SQL · PostgreSQL for self-hosted services
- Delivery and operations
- Docker and Docker Compose · GitHub Actions · Azure DevOps · Terraform on AWS · Azure · Cloudflare DNS and TLS · Entra ID SSO · Linux · Proxmox VE (QEMU, LXC, cloud-init) · VMware vSphere · Caddy and Apache · Uptime Kuma
- Testing and security
- PHPUnit · Playwright · parity and regression suites · Semgrep · Gitleaks · ESLint · PHPStan
- Applied AI
- Local LLM integration · execution-scored evals and model selection · prompt diagnosis · MCP servers and tool use · Claude Agent SDK · Claude Code, Codex, OpenCode · vLLM, Ollama and MLX
- Platforms
- Umbraco · Kentico and WordPress (migrations) · Google Analytics · ActiveCampaign · Salesforce integrations · BrowserStack · Litmus · Silverpop · Mailchimp
- Leadership
- Project management with in-house teams, outside agencies and freelance developers · production management · people management · training
Education and certifications
20+ years of professional software development in lieu of a degree. CompTIA A+ (2005) and Network+ (2006) · Red Hat RHCT and RHCE, RHEL 4 (2007, not current) · Microsoft Certified Professional · Umbraco developer training (2023).
Appendix: the full tool list
Checked against my own configs and repositories. The PDF leaves this list out.
- Coding agents
- Claude Code · Codex CLI · OpenCode · Cursor Agent · Gemini CLI · Grok CLI · Kimi Code · pi · Hermes · herdr
- Frontier models
- Claude Fable 5.1 · Claude Opus 5.5 · Claude Sonnet 5 · GPT-6 Astra · GPT-5.3 Codex · Kimi K3 · GLM-5.2 · Grok 4.6 · Qwen3 Coder Plus · Gemini
- Local LLMs
- Qwen3-Coder-Next · Qwen3.8 27B · Qwen3-Coder 30B · Nemotron 3.5 · Granite 4.1 · Gemma 4 · gpt-oss 20B · OLMo 3.1 · GLM-4.7 Flash · Hermes 3 · Llama 3.2 · served with vLLM, Ollama and MLX
- Data and RAG
- Text-to-SQL with Qwen2.5-Coder, SQLCoder and XiYanSQL · nomic-embed · ChromaDB · Meilisearch · Open WebUI · LibreChat · AnythingLLM
- Creative development: images, video and web assets
- ComfyUI · Flux.2 Klein · Flux Kontext and Krea · Qwen-Image Edit · Z-Image · SDXL · Wan 2.1/2.2 · InfiniteTalk · HunyuanVideo · ffmpeg · Adobe Photoshop and Illustrator for web assets · Adobe Lightroom for photography
- Marketing platforms
- ion interactive (formerly Liveball) landing pages · Silverpop and Mailchimp email · Litmus email testing · BrowserStack for responsive web and email testing · Salesforce integrations
- Voice
- ElevenLabs v3 · IndexTTS-2.5 · Kokoro · Chatterbox · F5-TTS · CosyVoice2 · Qwen3-TTS · fish-speech · Seed-VC · faster-whisper
- Agent infrastructure
- MCP servers, including AWS and Umbraco · Claude Agent SDK · Playwright for agent browser checks and end-to-end tests · reusable skills for deployment, browser checks, infrastructure and project workflows · Claude plugins · a Semgrep and Gitleaks security hook · shared agent memory vault · graphify
- Languages and frameworks
- C# and .NET in Visual Studio · Umbraco · PHP 8 · htmx · JavaScript and Node · TypeScript and Lit · Python · Kotlin and Compose · PowerShell · Bash
- Code review and validation
- CodeRabbit · Greptile · Macroscope · Semgrep · Gitleaks · ESLint · PHPStan
- Build, test and CI/CD
- GitHub Actions on self-hosted runners · Azure DevOps · PHPUnit · Deployer
- Cloud and infrastructure as code
- Azure · AWS with Terraform (EC2, RDS, S3, CloudFront, Route 53, WAF, Lambda) · Umbraco Cloud · Entra ID SSO · Cloudflare Tunnel
- Servers and data
- SQL Server · MariaDB · SQLite · Redis · PostgreSQL (self-hosted services) · Apache · Caddy
- Self-hosted platform
- Docker · Proxmox VE (QEMU, LXC) · TrueNAS · Forgejo · Vaultwarden · Authelia · Uptime Kuma · WireGuard · Home Assistant