Based in Vienna. CTO of Assetera, a MiFID II licensed investment firm for tokenized securities, where I rebuilt the complete technology stack in four months. Open to CTO, VP Engineering, and Head of Engineering conversations with payments, brokerage, and investment firms that need to enter or grow in the regulated European market. Remote-Europe and hybrid both work.
At a glance
CTO at Assetera (MiFID II investment firm) · CTO at Morpher Labs 2020-2026 · Co-founder of Permissionless · MSc Telematics, TU Graz
About
I'm a CTO who leads from the codebase. I set technical direction, write the architecture down, build the engineering culture, and still ship code when the hardest production problems show up.
My strongest fit is a fintech that has the licence, or is about to get it, and needs technology that keeps up. At Assetera I rebuilt the complete platform as a MiFID II and DORA ready system on Azure in four months, and put a team and a delivery cadence around it. Before that I spent six years as CTO of Morpher, a trading platform with ~681k accounts and 2,000+ markets. I know what regulators ask for, what auditors look at, and how to build so that both answers are already in the system.
Where I'm strongest
I'm strongest where the licence is real and the technology has to earn the regulator's trust.
- Payments and brokerage firms entering or scaling in the EU
- MiFID II investment firms, EMIs, and CASPs that need the tech to match the licence
- DORA readiness: ICT risk, incident response, third-party register, exit plans
- KYC, AML, appropriateness, and transaction monitoring built into the product
- Execution: platforms with good ideas that need to reach production
- Tokenized securities, stablecoins, and on-chain settlement
- Legacy or agency-built systems that need a rebuild without stopping the business
- Early-to-mid teams that need architecture and execution from one person
Work Experience
CTO of a MiFID II licensed investment firm for tokenized securities. Rebuilt the complete technology stack in four months: services, Azure as code, identity, compliance, on-chain settlement, and the delivery process around it.
CTO of Assetera, a European investment firm licensed under MiFID II that offers tokenized securities to retail and professional clients. DORA applies in full.
- A new foundation. I inherited a .NET monolith, infrastructure clicked together in the Azure portal, no CI/CD, and few tests. I ran an audit, presented it to the executive team, and ran my execution playbook: delivery cadence first, then engineering foundations, then the rebuild.
- Rebuilt the stack from scratch in four months. About 15 TypeScript services (marketplace, compliance and EDD, admin API with audit log, attestation signer, EVM and Stellar/Solana indexers, notifications, realtime stream, enrichment) and six frontends, all in production. Case study.
- Azure estate as code. OpenTofu modules for Container Apps, Front Door with WAF, Key Vault, Service Bus, Postgres, Redis, and observability across four environments. Keyless deploys with GitHub OIDC, image promotion from testnet to production, documented rollback. Case study.
- Compliance in the system, not next to it. KYC/KYB and EDD with Sumsub and Chainalysis, appropriateness tests, proof of funds, professional opt-up, a fail-closed audit stream, and an activity ledger for MiFID II record keeping, each with its own ADR. Case study.
- 44 ADRs set the target architecture: Keycloak identity with B2B2C tenancy, event-driven services, multi-chain indexing, per-market fees, primary issuance contracts. The client migration to Keycloak carries passwords and 2FA, so nobody signs up again.
- A clean external audit. Nethermind Security reviewed the primary-market settlement contracts in September 2026 and found zero issues at any severity, not even informational notes. Documentation and test suite were both rated High. Report.
- Brokerage on-chain. Primary sales of tokenized stocks (xStocks, Ondo) through RFQ with atomic on-chain settlement on four chains, plus a bank-transfer rail with payer verification.
- Retired the legacy estate safely: a guided wind-down flow for existing clients, then subscriptions and clusters shut down step by step.
- AI-native delivery. 950+ of my own PRs merged across 29 repositories in four months, with agents doing the typing and every diff reviewed. Case study.
- Stack: TypeScript, Node.js, Next.js, PostgreSQL, Drizzle, Keycloak, Azure (Container Apps, Front Door, Key Vault, Service Bus, Entra ID), OpenTofu, GitHub Actions, Grafana, Solidity, Foundry.
Co-founder of a permissionless stablecoin protocol with a compliance-aware privacy layer. Owned protocol architecture, implementation, audit coordination, and developer docs. The project is on hold; I remain a co-founder.
Co-founder and CTO. Built a permissionless stablecoin protocol that combines on-chain overcollateralization, yield-generating collateral strategies, and privacy-preserving compliance infrastructure. The project is on hold since 2026; I remain a co-founder.
- Sole developer on the technical side: protocol, pool, compliance layer, and developer docs. Also drove strategy and marketing across upd.io, permissionless-technologies.com, and the preview.upd.io showcase app.
- Designed the full protocol stack: stablecoin issuance, collateral management, and a compliance-aware dual SNARK-and-STARK privacy layer.
- Built a production-direction post-quantum STARK verification path for Ethereum L1, with BLS12-381 SNARKs on the hot path for real 128-bit security and STARKs as the post-quantum vault layer. STARK proofs verify through SP1 wrapping today, with a clean upgrade path to native STARK verification when Ethereum supports it.
- Managed the audit process: auditor procurement, scope review, feedback loops, remediation, and follow-up iterations.
- Reached pre-launch on Sepolia, pre-audit, before the project went on hold.
- Stack: Solidity, Foundry, OpenZeppelin, SP1, Circom, TypeScript, Next.js.
CTO for a blockchain trading platform with ~681k accounts, 50-100k monthly actives, 2,000+ markets, a custom wallet, L2 infrastructure, and sub-500ms market-data systems. Owned engineering budget, roadmap facilitation, audits, and investor-facing product/tech updates.
Led engineering for a blockchain-based trading platform. ~681k accounts, 50-100k monthly actives, 2,000+ synthetic markets spanning equities, commodities, crypto, forex, indices, and a set of unique custom markets.
- Scaled engineering from 3 unstructured devs to 7 across 2 product teams (desktop and mobile). Senior ICs were promoted into team-lead roles, not replaced by outside hires.
- Owned development budget planning for AWS, tooling, audit work, and hiring expansion. Engineering usually ran at or under budget while preserving room for planned infrastructure and headcount growth.
- Owned technical roadmap facilitation with product, marketing, support, compliance, and engineering. We scored upcoming work by impact, difficulty, urgency, and effort so high-impact quick wins rose to the top and costly low-value items became visible before they consumed months of engineering time.
- Managed security and product audits: auditor procurement, offer review, scope definition, feedback loops, remediation, and follow-up iterations.
- Prepared monthly investor-facing product and technology updates covering roadmap progress, feature delivery, bugs, infrastructure, improvements, and engineering risk.
- Architected the Morpher Wallet. It is an encrypted, double-salted keystore that acts as an RPC-intercepting signer. The wallet itself only signs; the RPC sits outside the wallet, so it is chain-agnostic by design. ~681k wallets created. Works with any EVM chain.
- Designed and operated a custom Plasma L2 with in-house validators and 1-second block times, well before today's L2 ecosystem (Arbitrum, Optimism, Base) reached production maturity.
- Built a high-frequency tick-data pipeline that aggregates 8 sources at 1-2k msg/s average and 10k peak. 100% retention via S3 and Athena, with <500ms latency end to end.
- Migrated production smart contracts to upgradeable proxies. Coordinated multi-chain settlement across the in-house plasma chain, Polygon, and Base, with several hundred thousand on-chain transactions processed.
- Led incident response twice. An AWS datacenter fire forced a redesign of redundancy and failover automation. A supply-chain attack against a dependency tightened release verification and signature procedures. Both became lasting improvements.
- Stack: Node.js, AWS, Docker, PostgreSQL, RabbitMQ, Redis, Solidity, Foundry, Truffle, OpenZeppelin, Vue, Jira, Notion.
Bitcoders GmbH
CTO for blockchain and fintech client work. Owned architecture, delivery, budget-aware resourcing, roadmap facilitation, and client-facing technical decisions across concurrent engagements.
Led technical strategy and delivery for a portfolio of blockchain and fintech client projects.
- Built and ran a senior engineering team across multiple concurrent client engagements.
- Ran the same hiring loop I later refined at Morpher. Zero voluntary attrition on engineering hires.
- Owned roadmap facilitation, architecture, delivery, budget-aware resourcing, and client-facing technical decisions end to end.
Moschitz IT
Built SaaS, warehouse tracking, and bespoke cloud hosting systems from prototype to production.
Built an accounting SaaS and a warehouse tracking solution from prototype to production, plus the bespoke cloud hosting infrastructure that ran them.
- Stack: PHP, MySQL, Galera Cluster, Linux, Java, Android
Case studies
All case studies →Deeper write-ups on the systems above. Problem, constraints, architecture, what I owned, outcome, and tradeoffs.
Leadership operating system
How I run engineering teams. What I have actually built, not what I believe in.
Execution playbook, used for real. At Assetera, a regulated firm, it took four months: an audit, a delivery cadence, engineering foundations, a written target architecture, and a rebuilt stack in production. Read the playbook.
Run engineering with AI agents as part of the team. I steer, write the acceptance criteria, and review every diff; agents do the reading and typing. That is how one CTO merged 950+ PRs in four months without lowering the review bar. I open-sourced the tooling as flash-agents.
Work with compliance, not around it. KYC, AML, appropriateness, record keeping, and audit logging are product requirements with owners, tests, and ADRs, not a checklist after launch.
Scaled engineering from 3 unstructured devs to 7, split across 2 product teams (desktop and mobile). Senior ICs were promoted into team-lead roles, not replaced by external manager hires.
9 senior engineering hires across Bitcoders and Morpher. Zero voluntary attrition on those hires.
Owned development budget planning for infrastructure, tooling, audit work, and hiring expansion. Kept engineering spend at or under budget while preserving room for growth.
Owned technical roadmap facilitation at Morpher and Bitcoders. Product, marketing, support, compliance, and engineering scored items by impact, difficulty, urgency, and effort; the roadmap then surfaced quick high-impact wins and exposed expensive low-value work before it consumed the team.
Managed security and product audits across Morpher and Permissionless: auditor procurement, offer review, scope negotiation, feedback loops, remediation, and follow-up iterations.
Prepared monthly investor-facing technology and product updates covering roadmap progress, impact, feature delivery, bugs, infrastructure work, and engineering risk.
Built a hiring loop with role-specific coding exercises, structured feedback, and team calibration. I would port the same process directly into a new company.
Introduced the full Scrum cadence (planning, refinement, review, retro). On top of that, an executive-friendly forecasting layer so feature delivery, releases, and GTM stay aligned with the rest of the company.
Led incident response twice when it counted. An AWS datacenter fire pushed us to redesign redundancy and automate failover. A supply-chain attack against a dependency tightened our release verification and signature checks.
Owned performance reviews, including the hard ones.
Cross-functional ownership across product, design, marketing, compliance, and customer support. In an early-stage company, that is the default mode.
Operating principle: process should create clarity and throughput, not theater. A natural paper trail is useful; bureaucracy that slows delivery is not. Wins belong to the team; failures stop with the senior person.
Education
Telematics is about modeling, planning, implementing, operating and assessing complex hard- and software systems. Similar to Computer Science, but also covers the underlying electrotechnical layer. Specialization in Machine Learning and Signal Processing. Master's Thesis Project completed at the University of Western Australia (UWA) in Perth, focusing on Machine Learning and Natural Language Processing.
Skills
Regulated Fintech & Compliance
Cloud & Platform
Blockchain & Protocols
Backend & Infrastructure
AI & Data
Leadership & Delivery
Tools, courses, and infrastructure I've built
Public projects beyond the company work above. Most of them exist because I needed them while running engineering.
flash-agents
A Claude Code plugin that lets Claude steer while cheap DeepSeek Flash workers do the reading and the typing. Every writing job runs in a disposable copy-on-write clone of the repository and comes back as a git-computed patch, so the evidence is the diff, not the worker's story. Fan-out of up to 16 tasks per call. Built for, and used daily on, the Assetera rebuild.
PrivateGoat
A native macOS menu-bar app that records both sides of a call, transcribes it on the Mac with whisper.cpp, and turns it into summaries, action items, and Jira-ready to-dos with a local model. Meeting audio never leaves the Mac, there is no analytics, and nothing reaches Jira until you send it. Privacy by design for people who sit in regulated meetings all day. Free public beta through Homebrew.
Ethereum Blockchain Developer Course
One of the largest Ethereum developer education platforms. Over 140,000 students learned Solidity, smart contract security, Foundry, Hardhat, and production Web3 workflows on the video course since 2016. Beyond the VoD platform, I have lectured in-person at the University of Rome, delivered Fortune 500 corporate training through the Blockchain Training Alliance, and run developer training for public-sector organizations. Public authority, mentorship at scale, and a long-term commitment to the space.
Autoreel: Agent-Driven Video Pipeline
A 10-stage Claude Agent SDK pipeline that produces developer-tutorial videos end to end. Word-anchored Whisper timing as the canonical clock, Remotion for compositional rendering, Playwright + CDP for screen capture, an injected EIP-1193 wallet mock with EIP-6963 announce for Web3 demos, and Claude-driven visual gates that catch broken layouts before render. Outputs 1080p long-form and 9:16 shorts from one storyboard. Built to scale Solidity tutorial production to the next cohort of learners.
Let's talk
For CTO, VP Engineering, or Head of Engineering conversations, email me at me [at] thomaswiesner.com or reach out on LinkedIn or Farcaster.
I'm especially interested in payments, brokerage, and investment firms that want to enter or grow in the regulated European market, and in teams whose platform has stalled and needs to ship again. I read every thoughtful, relevant inbound.