Ahmed Ikram

The Problem

NCR Atleos ATMs generate MBs of log data each day across several sources, application logs, hardware sensor metrics, terminal handler logs, Kafka, Prometheus, Windows OS and GCP cloud metrics. Field engineers are flying blind: faults surface only after customers report them, and root-causing a single ATM meant grepping millions of unstructured lines by hand.

My Role, Solo Builder

LAAD began as part of a 7-person university team project. After the module ended, I continued developing it independently throughout the summer and substantially rebuilt the system. The original submission had basic rule-based detection and a simple database-writing generator, the majority of the current architecture was designed, implemented and deployed by me alone.

• 2.5M events every 24 hours at ~100 messages/second with zero loss
• 0.92 held-out macro-F1 on the XGBoost detection ensemble — 0.94 on a temporal holdout, 0.93 on a held-out second generator configuration
• 0.708 context recall from the agentic RAG assistant, 2× the deterministic baseline
• Typed decisions at ~$16 per 1M via a System One layer (TypeSafe Jev) — judgments 18× cheaper, 83% agreement with human verdicts

Seven heterogeneous sources stream into a continuous Kafka producer (gzip, acks=all, retries 5), land on two KRaft topics with 7-day retention, and are consumed by a pipeline that deduplicates, parses, dual-writes to PostgreSQL and a ChromaDB vector store, and feeds a detection engine every 30 seconds, surfaced through a FastAPI backend and a React dashboard.

• Ingestion, Kafka KRaft, 2 topics × 3 partitions, ~65% gzip compression (250KB/s → 85KB/s on the wire), 3.5GB/day → 1.2GB/day on disk
• Reliability, dedup via Redis SET + 10K in-memory LRU, manual offset commits, failed messages land on a Redis Stream DLQ with exponential backoff (5s → 10s → 20s)
• Schema-on-read storage, PostgreSQL 16 with JSONB payloads: adding a new source means adding a parser, never a migration. 10 tables, 3 views, 15 indexes, hourly retention cleanup
• Vector store, ChromaDB with semantic chunking and local 768-dim embeddings for the RAG assistant
• API, FastAPI, 30 endpoints across 6 routers, JWT auth and 8 Redis patterns (rate limiting, caching, locks, Pub/Sub, DLQ) with graceful degradation

A LangGraph agent with 12 MCP tools answers operator questions over the anomaly corpus: ChromaDB retrieval with metadata filters and temporal decay, cross-encoder reranking, then a 4-stage reasoning loop, self-consistency sampling, verbalised confidence, reflexion and citation grounding, fused into a single score (0.30 retrieval + 0.25 self-consistency + 0.25 verbalised + 0.20 grounding) via uncertainty-weighted averaging with static calibrated weights.

Evaluated on a 50-query golden set (82% human-reviewed) with a committed baseline and a CI gate that fails any PR with faithfulness < 0.9, context recall < 0.3, or a drop > 0.05 vs baseline.

• 1,974 automated tests, 1,439 pytest (10 tiers), 495 vitest (41 suites), 10 Playwright E2E, 30 Terraform assertions, with Codecov and a checkov-hardened IaC pipeline
• Zero-trust deployment, 6 least-privilege IAM roles (OIDC-based CI/CD, ECS, SageMaker, CloudWatch, MLflow), 8 secrets injected from Secrets Manager, no long-lived credentials
• MLOps, MLflow on RDS with S3 artifact storage, champion alias promotion, auto-retrain on corruption, every run tagged with its git SHA
• Observability, vendor-neutral OpenTelemetry tracing across 4 services via OTel Collector → Jaeger (dev) on 2 golden paths with W3C context through Kafka headers; AgentTrace table, Redis Pub/Sub alerts, CloudWatch + Grafana dashboards

Beauly Mini Market

Retail Assistant • September 2023 - Present

Zulus Peri Peri Grill Dundee

Front of House • June 2021 - September 2023

University of Dundee

BSc (Hons) Computer Science (Data Science and AI) • September 2023 - June 2027 (Expected)

High School of Dundee

Secondary Education • August 2018 - June 2023