EnChannel Medical, Inc.

EnChannel builds medical devices, which means every software artifact eventually has to stand up in front of the FDA. When I arrived, builds took about an hour and nothing about them was reproducible.

I re-architected the pipeline and spread the work across a fleet of self-hosted runners, which took builds from roughly 60 minutes down to about 5. Docker made the toolchain deterministic, so a build on a developer’s workstation produced the same result as one in CI. The end goal was byte-level reproducibility, for IEC 62304 verification and FDA submission.

I also implemented SPDX SBOM generation and audit in CI for every release artifact, aligned with FDA premarket cybersecurity guidance and traceable to upstream CVEs.

All of it ran inside FDA-regulated, IEC 62304-aligned lifecycle constraints: chain-of-custody, access control, traceability, and audit-readiness at every stage, with the build fleet held to the same controls.