Mohammed Al Sahaf

Digital payments specialist and software engineer bridging FinTech product management with open-source systems engineering. A decade across the payments value chain — acquirers, payment gateways, and device wallets — paired with hands-on engineering as a co-maintainer of the Caddy web server.

• LinkedIn
• GitHub
• Blog

Experience

FinTech & Digital Payments

Mastercard — Associate Managing Consultant · Riyadh, Saudi Arabia · Feb 2025 – Present

Technical consultant for Mastercard Payment Gateway Services (MPGS) clients and key merchants across the region.

• Own the technical relationship with acquirers, PSPs, and key merchants — from solution design through integration to production support
• Advise clients on MPGS capabilities and payments best practices, turning ambiguous business needs into concrete gateway solutions
• Design bespoke integrations that unlock new payment flows and revenue for clients
• Feed regulatory shifts and emerging payment technologies in the region back into client engagements and solution design

Gareeb.sa (قريب | قاعات التدريب) — Technical Co-Founder · Riyadh, Saudi Arabia · Dec 2025 – Present

Building the technology behind a marketplace for training venues — architecture, engineering, and operations.

Samsung Electronics — Technical Product Manager · Riyadh, Saudi Arabia · Aug 2023 – Jan 2025

Technical lead for the launch of Samsung Pay / Samsung Wallet in Saudi Arabia — a three-way bridge between the local subsidiary, the regulator, and the wallet engineering teams at Samsung HQ in South Korea.

• Turned Saudi regulatory requirements into scoped, deliverable projects for the centralized wallet team at HQ, keeping the launch compliant with both regulator and payment-scheme rules
• Led integration and quality assurance with every local card issuer to bring their cards into the wallet
• Brought Samsung Pay acceptance to the market through payment gateways and payment (technology) service providers (PSP/PTSP)
• Extended the wallet beyond payments through partnerships with non-payments services

neoleap — Product Manager · Riyadh, Saudi Arabia · Aug 2022 – Sep 2023

Product owner of the e-commerce payments stack at AlRajhi Bank’s payments technology arm.

• Owned Neogate (formerly ARBPG), the bank’s payment gateway: roadmap, development, and day-to-day operations
• Ran the bank’s MPGS and CyberSource gateway operations
• Charted the roadmap that shaped neoleap’s e-commerce solutions offering

SABB — Product Manager · Riyadh, Saudi Arabia · Jul 2020 – Jun 2022

Wrangler of backlog; usher of the future.

• Drove the enhancement roadmap of the bank’s payment gateway service
• Dug into and cleared a backlog of historical incidents, and became the escalation point for the non-trivial cases front-line support couldn’t crack
• Streamlined the end-to-end merchant workflow, from onboarding to settlement

Alawwal Bank — Delivery and Client Support Assistant Manager · Riyadh, Saudi Arabia · Aug 2017 – Jul 2020

Hired for a client-facing role; became the department’s engineer — the technical bridge between clients, IT, and vendors.

• Onboarded corporate clients onto Mastercard Payment Gateway Services (MPGS) and guided them to successful integrations across Hosted Checkout, Hosted Session, and the REST API
• Built internal tooling for daily operations and reporting (Go, SQLite), replacing manual processes
• Built client-facing software for Corporate Internet Banking (Node.js, Electron, TypeScript) and kept the legacy Java tooling alive
• Guided clients through B2B integrations and built income and service-utilization reporting

Software Engineering

Cognizant — Programmer Analyst · Riyadh, Saudi Arabia · Sep 2015 – Aug 2017

Test engineering for business systems.

• Translated functional specifications into comprehensive test suites, probing system boundaries for the failure scenarios the specs didn’t spell out
• Automated Sanity, SIT, and UAT test cycles with Selenium

Saad Specialist Hospital — Programmer · Khobar, Saudi Arabia · Feb 2014 – Sep 2015

Web developer on the in-house EMR (Electronic Medical Records) system (Java, Sencha Ext JS) — and the team’s quiet modernizer.

• Lead developer of the tablet version of SaadEMR
• Brought the team onto version control (Fossil SCM, later GitLab) from a folder-copy workflow
• Wired client-side error capture into an automated Bugzilla crash-reporting pipeline, so bugs reported themselves

Open Source

Caddy — Co-Maintainer · 2019 – Present

Co-maintainer of the Caddy web server, the extensible, Go-powered server known for automatic HTTPS. Maintainer of numerous Caddy modules and contributor to the project’s infrastructure, including the custom-build service (xcaddy-based buildworker) and its observability stack.

Kadeessh (formerly caddy-ssh) — Author

Designed and implemented a general-purpose, extensible, modular, memory-safe SSH server in Go, leveraging Caddy’s modular architecture to simplify secure remote access.

samsungpay-codec — Author

A Go module illustrating the non-conventional JWE decryption of Samsung Pay payment credentials for merchants and PSPs, including mocking facilities for testing. See Security Guarantees of Samsung Pay.

Caddy modules — Author & Maintainer

• caddy-git-fs: virtual filesystem for Caddy backed by a git repository
• caddy-ngrok-listener: listener wrapper to automatically serve Caddy over an ngrok tunnel
• caddy-pocketbase: PocketBase embedded in Caddy
• caddy-encrypted-storage: storage middleware ensuring encryption at-rest
• caddy-throttle-listener: throttles incoming connection bandwidth
• caddy-storage-loader: config loader that reads from Caddy storage
• caddy-aws-transport: injects AWS v4 signatures in reverse-proxy requests
• caddy_profiling: continuous profiling app for Caddy
• caddy-zero-trust-tls-everywhere: reference zero-trust architecture with Caddy. See Zero-Trust Architecture with Caddy.

Speaking & Writing

• GopherCon Europe 2023 (Berlin, Germany) — The Road to CGO-Less is Paved
• Xpand Conference 2025 (Amman, Jordan) — Towards Validated HTTP Implementation: talk on HTTP, its RFCs, and the gap between specification and implementation
• Fablab Al-Ahsa — 3-Day Python crash course
• Grafana Labs blog — How the open source Caddy server uses Grafana Cloud for full-stack observability (guest post, 2024)
• Technical writing on this blog, in English and Arabic: HTTP validation, zero-trust architecture with Caddy, Go compilers, HTTPS من دون مشقة باستخدام كادي, and more

Skills

• Payments: online payment solutions, mobile payments & device wallets (Samsung Pay), payment gateways (MPGS, CyberSource), payments regulatory compliance
• Engineering: Go, Dart, TypeScript/Node.js, Java, HTTP & network protocols, distributed systems, observability, test automation
• Languages: Arabic (native), English (full professional)

Education

• University of the People — BS, Computer Science
• Tulsa Tech — Certificate, Network Systems Administration