Darren Kelly
Regulated Operations · AI Infrastructure · Compliance Engineering
I build software for environments where being wrong has consequences. Twenty years running regulated operations taught me what breaks. Now I build the systems that keep it from breaking.
Selected engineering work.
Operational builds, security lab work, and research prototypes, with the scope of each described below.
Regulated Compliance Platform — Skilled Nursing
Self-hosted compliance and survey readiness platform for a licensed skilled nursing facility. Admissions decision engine encoding regulatory gates and clocks, finance variance engine, capability matrix enforcing occupancy ceilings. Local infrastructure, encrypted storage, role-based access control.
Compliance Workflow Hub
Automation appliance for a regulated care environment. Document retrieval, survey preparation, incident tracking, infection control, training compliance, financial analytics. FastAPI, progressive web app, local language model, PostgreSQL. Every output routes to human review.
Regulated Production Automation — Medical Cannabis
Automation for a licensed medical cannabis facility under state oversight. Regulator monitoring with cryptographic change detection, yield intelligence, nutrient forecasting, SOP retrieval assistant, and a compliance auditor that checks procedures against state regulation text and cites the exact rule.
AI Security Operations Lab
Self-hosted security lab: real SIEM, instrumented endpoint, MITRE ATT&CK mapped attack simulation, and an evaluation harness that measures actual detection coverage with timestamps. Includes a published correction walking a false one hundred percent claim back to an honest thirty-three percent.
Intelligent Ontology — Research Prototype
Research into evidence-linked graph memory for software agents. A delivered fact-review tool retrieves synthetic evidence with citations, time and identity handling, and separate human review. Model comparisons and commercial usefulness remain to be evaluated.
Twenty years, four industries.
Regulated Production Operations — Medical Cannabis
Operations leadership, concurrent systems engineering
Twenty years culminating in a fifty-person regulated production facility. Built the internal systems that run it: SOP compliance and authoring, production tooling, shared AI infrastructure, evaluation and cost controls. Authored every standard operating procedure in the department.
Independent Systems Engineering — Starbloom Consulting LLC
Sole owner
Compliance platforms, automation pipelines, security labs, and AI systems shipped to production. Full stack: Python, FastAPI, Next.js, Docker, PostgreSQL, n8n, local model inference.
Behavioral Health Services — State Licensed Program
House Manager, concurrent trainer
Clinical documentation, incident reporting, and oversight compliance under COMAR. Consulted with the Kennedy Krieger Institute on behavioral intervention practice. Served on a four-person pilot team delivering crisis prevention certification across multiple Maryland organizations.
Construction and Environmental Operations
Regional Manager, promoted from Superintendent
Erosion control and site work across a dispersed territory. OSHA requirements, permitting, inspection compliance, crew and subcontractor coordination.
The rules are the specification.
I have operated inside four regulatory regimes. The rules are not the obstacle — they are the specification.
Medical cannabis.
State licensed production under continuous oversight. COMAR regulations, METRC track and trace, private applicator licensing, documented procedures for every process, inspection readiness as a standing condition. A missed rule is a license risk.
Skilled nursing.
COMAR Title 10 and federal CMS requirements. Survey readiness, admissions regulatory gates, infection control, protected health information under HIPAA. The documentation is the record, and the record is what gets audited.
Behavioral health.
State licensed services for adults with intellectual and developmental disabilities under COMAR. Clinical supervision, strict documentation, incident reporting, oversight. Worked alongside the Kennedy Krieger Institute on behavioral intervention practice.
Construction and environmental.
OSHA, permitting, and inspection compliance across a dispersed regional territory.
I have worked where an auditor, an inspector, or a regulator can arrive unannounced and the paperwork has to be right. That is the same discipline I bring to software. Validation gates, audit trails, and human review checkpoints are not features I add because a framework says so. They are how I already think.
How I got here.
I came up through construction sites, erosion control crews, a state licensed behavioral health program, and a regulated medical cannabis facility. Every one of those jobs had the same problem: real work, real stakes, and systems held together with paper, spreadsheets, and somebody's memory.
I kept running into problems that software could solve. Eventually I stopped waiting for someone else to solve them.
Today I run a regulated production operation and, in a concurrent capacity, design and build the internal systems that keep it running. I also ship independent software: compliance platforms, security labs, automation pipelines, and AI systems in production.
I am not a person who talks about what AI could do. I am a person who has deployed it, measured it, found where it failed, and fixed it.
Operating principles.
Ship it, then earn the trust.
Shipping is the easy half. The hard half is making a system trustworthy enough that people lean on it.
Adoption is a design problem.
Years driving new methods into a frontline workforce with no authority to mandate anything. Documentation, demos, hands-on pairing until the tool sticks.
Measure, or it did not happen.
Reliability, adoption, quality, cost. If I cannot show the number moved, I do not claim the win.
Be honest about what is unresolved.
When a metric was wrong, I corrected it in public. Same standard applies to evaluating tools for a team.
Paper is the record.
In regulated environments, software assists and humans decide. I build systems that support the person accountable for the outcome.
Technical range.
AI and Agents: LLM orchestration, agent and tool design, prompt and context engineering, retrieval augmented generation, vector search, evaluation harnesses, guardrails, human-in-the-loop review
Engineering: Python, FastAPI, TypeScript, Next.js, React, Docker, PostgreSQL, REST APIs, Git, CI pipelines, test automation, n8n, Linux
Data and Observability: PostgreSQL, Google BigQuery, Looker Studio, tracing, monitoring, evaluation frameworks, cost tracking
Security and Governance: Detection engineering, MITRE ATT&CK, access controls, auditability, PHI architecture, regulated delivery
Operations: Team leadership at fifty-person scale, production planning, SOP authoring, training and adoption
Credentials.
Twenty years across construction supervision, regional operations management, state licensed behavioral health, and regulated production leadership. Certified in METRC track and trace, Maryland Responsible Vendor Training, and Maryland private applicator licensing. Board member for a youth football organization and a Little League baseball coach.
Get in touch.
I am always interested in work where the systems have to be right.
Clear Spring, Maryland