Build ML Anomaly Detection Backend
Budget / Salary£250–750
TypeFreelance project
LocationRemote
Posted3 hours ago
Sentinel Ledger: Real-Time Risk & Anomaly Intelligence Backend
THE ROLE
We're hiring a senior backend architect (or a small team, if bidding as an agency) to build a production-grade, real-time transaction-monitoring system from the ground up. This isn't a prototype or a portfolio piece — the end result needs to run live, under real load, in a real enterprise environment, with real money moving through it.
Transactions flow in continuously, get scored for risk in near-real-time by trained ML models, and surface actionable alerts through a fast, well-documented API — all while the whole stack stays observable, scalable, and secure.
We won't accept stubbed-out logic, hardcoded thresholds standing in for real models, mocked data streams, or anything that only works in a demo. If it can't survive production traffic, it doesn't count.
WHAT YOU'LL BE BUILDING
1. Ingestion Layer
- A distributed streaming pipeline (Kafka + Spark Streaming) that keeps pace with high transaction volume in real time, with no backlog buildup
- Validation, cleanup, and schema enforcement built directly into the pipeline, not bolted on after
2. Feature Store
- A single, centralized feature repository
- Streaming and batch feature computation running in parallel, kept consistent with each other
3. Detection & Scoring Engine
- Hybrid anomaly detection: statistical thresholds combined with a trained LSTM (recurrent) model — no static rule sets pretending to be ML
- An ensemble layer that blends model outputs into a single weighted threat score
- Sub-second inference, every time
4. Explainability Layer
- SHAP (or a comparable method) attached to every prediction
- A human-readable explanation accompanying each score, no black-box outputs
5. API Layer
- FastAPI, cleanly modularized by domain
- OAuth2/JWT for enterprise-grade auth
- Each major function deployable as its own microservice
- Full OpenAPI/Swagger documentation
6. Infrastructure
- Kubernetes, multi-node, production-configured
- Full CI/CD, no manual build/deploy steps
- Observability via Prometheus + Grafana (metrics, logs, alerting)
- Canary or blue-green rollout strategy
- Local-only setups or docker-compose without a real scaling path will not pass review
7. QA & Load Validation
- Load and concurrency testing at peak projected volume
- A formal go/no-go readiness review before anything touches production
PERFORMANCE BENCHMARKS (NON-NEGOTIABLE)
- Ingestion throughput: 50,000+ events/sec
- End-to-end pipeline latency: 2.0 seconds or less
- Feature lookup time: 50 ms or less
- Model precision (true positives): 90% or higher
- Inference compute time: 80 ms or less
- API round-trip response: 400 ms or less
Missing any one of these means the deliverable isn't accepted.
Uptime target: 99.5%, measured monthly (standard exclusions apply: scheduled maintenance, third-party outages, force majeure, unauthorized changes).
POST-LAUNCH SUPPORT
Coverage window: 09:00 to 18:00 GMT/BST
Sev 1 (full outage): triage in 4 hours, resolved in 24 hours
Sev 2 (major feature broken): triage in 8 hours, resolved in 48 hours
Sev 3 (minor issue): triage in 1 business day, resolved in 5 business days
COMPENSATION
Total: £2,300 fixed, paid in two milestones
Milestone 1: £2,100, released at contract start to cover environment setup, cloud resources, and initial pipeline development. This payment does not constitute approval, sign-off, or a waiver of any technical requirement. All specs, benchmarks, and runtime targets in this brief remain fully in force regardless.
Milestone 2 (final settlement): £200, released only after full production go-live, all services verified active and meeting every latency/throughput benchmark, and complete handover (source code, model artifacts, credentials, and documentation). If exit criteria aren't met, this final payment is forfeited.
DEFINITION OF DONE
All of the following, simultaneously, no partial credit:
- Live in a real cloud environment, not a staging sandbox
- Every component listed above deployed and verified
- Models producing genuine predictions on real data
- Benchmarks holding under actual load, not synthetic tests
- CI/CD and monitoring fully operational
- Documentation and runbooks delivered
- All credentials, repositories, and model files transferred
Acceptance is binary. "Nearly done," "beta," and "mostly working" submissions are not accepted, and there's no prorated payment for partially completed modules.
COMPLIANCE & SECURITY
Must align with ISO/IEC 27001, SOC 2, and applicable PCI-DSS standards. All data handling must comply with UK/EU GDPR; synthetic or anonymized data may only be used where legally appropriate.
IP, CONFIDENTIALITY & LEGAL TERMS
IP transfer: Upon final payment, all custom code, models, configs, and documentation transfer fully to the Employer. The developer retains rights to any pre-existing generic tooling, boilerplate, or reusable infrastructure scripts not built specifically for this project.
Confidentiality: Indefinite, for both parties, covering architecture, workflows, models, live data, secrets, and configs.
Breach: Failure to deliver a fully functioning, benchmark-compliant production system is treated as material breach, entitling the Employer to terminate and seek recovery of funds paid.
Suspension rights: The developer may pause work for unpaid invoices (30+ days), Employer breach of core terms, discovered misuse, or an urgent unpatched security risk.
Liability: Standard statutory limits apply; no limitation on liability for death or injury from negligence, fraud, or non-waivable statutory duties.
Force majeure: Standard carve-outs for events outside either party's control.
Communication: All binding communication must occur through Freelancer.com; off-platform agreements carry no contractual weight.
Governing law: England and Wales, exclusive jurisdiction.
WHO WE'RE LOOKING FOR
- A demonstrated track record deploying high-availability distributed systems to production, not just prototypes
- Deep hands-on experience with high-throughput streaming architectures
- Experience containerizing and operating ML systems at scale
- Strong working knowledge of Kafka, Spark, Kubernetes, and FastAPI
TO APPLY, INCLUDE
- Case studies from real production deployments (sandboxes or demos won't count)
- A high-level technical design proposal
- Team structure and resourcing plan, if applying as an agency
- A milestone-based delivery timeline
THE ROLE
We're hiring a senior backend architect (or a small team, if bidding as an agency) to build a production-grade, real-time transaction-monitoring system from the ground up. This isn't a prototype or a portfolio piece — the end result needs to run live, under real load, in a real enterprise environment, with real money moving through it.
Transactions flow in continuously, get scored for risk in near-real-time by trained ML models, and surface actionable alerts through a fast, well-documented API — all while the whole stack stays observable, scalable, and secure.
We won't accept stubbed-out logic, hardcoded thresholds standing in for real models, mocked data streams, or anything that only works in a demo. If it can't survive production traffic, it doesn't count.
WHAT YOU'LL BE BUILDING
1. Ingestion Layer
- A distributed streaming pipeline (Kafka + Spark Streaming) that keeps pace with high transaction volume in real time, with no backlog buildup
- Validation, cleanup, and schema enforcement built directly into the pipeline, not bolted on after
2. Feature Store
- A single, centralized feature repository
- Streaming and batch feature computation running in parallel, kept consistent with each other
3. Detection & Scoring Engine
- Hybrid anomaly detection: statistical thresholds combined with a trained LSTM (recurrent) model — no static rule sets pretending to be ML
- An ensemble layer that blends model outputs into a single weighted threat score
- Sub-second inference, every time
4. Explainability Layer
- SHAP (or a comparable method) attached to every prediction
- A human-readable explanation accompanying each score, no black-box outputs
5. API Layer
- FastAPI, cleanly modularized by domain
- OAuth2/JWT for enterprise-grade auth
- Each major function deployable as its own microservice
- Full OpenAPI/Swagger documentation
6. Infrastructure
- Kubernetes, multi-node, production-configured
- Full CI/CD, no manual build/deploy steps
- Observability via Prometheus + Grafana (metrics, logs, alerting)
- Canary or blue-green rollout strategy
- Local-only setups or docker-compose without a real scaling path will not pass review
7. QA & Load Validation
- Load and concurrency testing at peak projected volume
- A formal go/no-go readiness review before anything touches production
PERFORMANCE BENCHMARKS (NON-NEGOTIABLE)
- Ingestion throughput: 50,000+ events/sec
- End-to-end pipeline latency: 2.0 seconds or less
- Feature lookup time: 50 ms or less
- Model precision (true positives): 90% or higher
- Inference compute time: 80 ms or less
- API round-trip response: 400 ms or less
Missing any one of these means the deliverable isn't accepted.
Uptime target: 99.5%, measured monthly (standard exclusions apply: scheduled maintenance, third-party outages, force majeure, unauthorized changes).
POST-LAUNCH SUPPORT
Coverage window: 09:00 to 18:00 GMT/BST
Sev 1 (full outage): triage in 4 hours, resolved in 24 hours
Sev 2 (major feature broken): triage in 8 hours, resolved in 48 hours
Sev 3 (minor issue): triage in 1 business day, resolved in 5 business days
COMPENSATION
Total: £2,300 fixed, paid in two milestones
Milestone 1: £2,100, released at contract start to cover environment setup, cloud resources, and initial pipeline development. This payment does not constitute approval, sign-off, or a waiver of any technical requirement. All specs, benchmarks, and runtime targets in this brief remain fully in force regardless.
Milestone 2 (final settlement): £200, released only after full production go-live, all services verified active and meeting every latency/throughput benchmark, and complete handover (source code, model artifacts, credentials, and documentation). If exit criteria aren't met, this final payment is forfeited.
DEFINITION OF DONE
All of the following, simultaneously, no partial credit:
- Live in a real cloud environment, not a staging sandbox
- Every component listed above deployed and verified
- Models producing genuine predictions on real data
- Benchmarks holding under actual load, not synthetic tests
- CI/CD and monitoring fully operational
- Documentation and runbooks delivered
- All credentials, repositories, and model files transferred
Acceptance is binary. "Nearly done," "beta," and "mostly working" submissions are not accepted, and there's no prorated payment for partially completed modules.
COMPLIANCE & SECURITY
Must align with ISO/IEC 27001, SOC 2, and applicable PCI-DSS standards. All data handling must comply with UK/EU GDPR; synthetic or anonymized data may only be used where legally appropriate.
IP, CONFIDENTIALITY & LEGAL TERMS
IP transfer: Upon final payment, all custom code, models, configs, and documentation transfer fully to the Employer. The developer retains rights to any pre-existing generic tooling, boilerplate, or reusable infrastructure scripts not built specifically for this project.
Confidentiality: Indefinite, for both parties, covering architecture, workflows, models, live data, secrets, and configs.
Breach: Failure to deliver a fully functioning, benchmark-compliant production system is treated as material breach, entitling the Employer to terminate and seek recovery of funds paid.
Suspension rights: The developer may pause work for unpaid invoices (30+ days), Employer breach of core terms, discovered misuse, or an urgent unpatched security risk.
Liability: Standard statutory limits apply; no limitation on liability for death or injury from negligence, fraud, or non-waivable statutory duties.
Force majeure: Standard carve-outs for events outside either party's control.
Communication: All binding communication must occur through Freelancer.com; off-platform agreements carry no contractual weight.
Governing law: England and Wales, exclusive jurisdiction.
WHO WE'RE LOOKING FOR
- A demonstrated track record deploying high-availability distributed systems to production, not just prototypes
- Deep hands-on experience with high-throughput streaming architectures
- Experience containerizing and operating ML systems at scale
- Strong working knowledge of Kafka, Spark, Kubernetes, and FastAPI
TO APPLY, INCLUDE
- Case studies from real production deployments (sandboxes or demos won't count)
- A high-level technical design proposal
- Team structure and resourcing plan, if applying as an agency
- A milestone-based delivery timeline
Apply on Freelancer →
Project sourced from Freelancer.com. Applications happen directly on the original platform — we never collect your data.