Umar Draz
Verified Expert in Engineering
Software Engineer and Developer
Dubai, United Arab Emirates
Toptal member since June 17, 2019
Umar is a principal AI engineer and founder of CodexaAI, with 16 years of experience building production software for global clients. He builds agentic systems that businesses trust with live data: RAG pipelines over per-tenant knowledge bases, MCP tool layers that answer accurately over real records, and approval architectures where an agent can propose a consequential action but never authorize one. He works with Python, FastAPI, Django, TypeScript, and AWS, and scaled platforms to 1M+ users.
Portfolio
Experience
- Python - 10 years
- Multi-tenant Architecture - 8 years
- Artificial Intelligence (AI) - 5 years
- FastAPI - 4 years
- Retrieval-augmented Generation (RAG) - 3 years
- LLM Orchestration - 3 years
- Model Context Protocol (MCP) - 2 years
- Amazon Bedrock AgentCore - 1 year
Work Experience
Founder & Principal Engineer
CodexaAI
- Shipped a multi-tenant conversational AI platform to production on AWS that captures inbound business messages, answers them from each client's own data, qualifies the lead, and books a real calendar slot.
- Built the RAG layer over per-tenant knowledge bases on PostgreSQL with pgvector, covering chunking, retrieval tuning, and three interchangeable embedding providers behind one factory.
- Designed an agent authorization architecture on AWS Bedrock AgentCore using Gateway, Runtime, Memory, Identity, and Policy, where the model proposes a consequential action but cannot approve one.
- Made approval tokens single-use, short-lived, signed, and bound to one action, with the signing key unreadable by the agent role, and that property asserted against synthesized CloudFormation.
- Exposed Lambda tools as MCP tools with SigV4 inbound authentication and wrote Cedar policies to govern which actions an agent is permitted to request.
- Ran the AWS estate end-to-end across Lambda, API Gateway, RDS, S3, SQS, IAM, and Secrets Manager, with SAM and CDK for infrastructure as code and scripted credential rotation.
- Shipped a cross-platform mobile product to the App Store and Google Play with crash reporting that strips PII, accessibility enforced by a repository-wide test, and notification duplication.
- Built release automation that inspects the built artifact instead of trusting a zero exit code, after a release shipped, pointing at localhost while passing every gate that existed.
Principal Software Engineer
IT Pixelz
- Built an MCP tool layer with its own intent resolution pipeline so an AI assistant could answer natural language questions over live customer records in a multi-tenant CRM.
- Moved aggregation into the database so counts reflect the whole dataset rather than one fetched page, ending a class of answers that were fluent, confident, and wrong.
- Made a dropped filter condition a hard error instead of a silent no op, and separated read intent from write intent, so a question about what failed was no longer treated as a request to send.
- Pinned every corrected AI behavior with a regression test so each class of grounding failure could not return, building a durable suite around answer correctness.
- Designed and maintained multi-tenant isolation with schema separation so one tenant's data is structurally unreachable from another.
- Integrated Anthropic and OpenAI behind a single provider-agnostic interface and used AutoGen for multi-agent workflows across the platform.
- Cut the main front-end bundle from 2,733 KB to 749 KB by lazy loading four campaign feature areas, and ended a signed-out refresh loop that had made the login form unreachable.
- Architected an eCommerce platform scaling to over 500,000 daily visitors, driving a 30 percent increase in sales and improving performance by roughly 50 percent under peak traffic.
- Authored the open source Flamingo WordPress plugin, now at over 700,000 active installs, and delivered more than 200 client projects across AI, automation, and web platforms.
- Led engineering teams of up to 15 developers across back end, front end, QA, and DevOps, running hiring, code review, architecture standards, and client communication.
Principal Software Engineer
Dawsun Technologies
- Architected eCommerce platforms handling over 1 million daily visitors with zero downtime, through caching, query optimization, and infrastructure tuning.
- Built recommendation and personalization engines on customer behavior data that lifted engagement by 50 percent for major eCommerce clients.
- Developed machine learning models in Python to predict customer buying patterns, boosting sales by 30 percent for retail clients.
- Designed and shipped cross-platform mobile applications for iOS and Android alongside the web platforms they extended.
- Containerized and orchestrated client applications with Docker and Kubernetes, standardizing deployment across environments.
- Directed cross-functional engineering teams of up to 20 people, delivering high-impact projects on time and within budget.
- Contributed to open source projects that now carry over 900,000 active installs across the community.
Project History
AI Assistant Grounded on Live Business Data
Solution: I built and hardened the MCP tool layer behind the assistant, with its own intent resolution pipeline. Aggregation moved into the database, so counts reflect the entire dataset. A dropped filter became a hard error instead of a silent no op. Read intent was separated from write intent. Every corrected behavior was pinned with a regression test.
Result: Answers that are correct across the whole dataset, failures reported honestly instead of as invented results, and a durable test suite that stops each class of grounding failure from returning.
Agent Authorisation on AWS Bedrock AgentCore
Solution: I designed an architecture in which the tool the model sees has no approval field, so it cannot supply one. Approval tokens are single-use, short-lived, signed, and bound to one action, and only an authenticated administrator can mint one through a separate endpoint. The signing key is readable only by the executing function, and the agent role has no access to it. That property is asserted against synthesized CloudFormation rather than assumed.
Result: Prompt injection has no mechanical path to privilege, and a test suite proves the guarantee holds even when the model ignores every instruction in its prompt.
Multi-tenant Conversational AI Platform
Solution: I built a platform that captures inbound messages, answers them from each client's own data, qualifies the inquiry, and books a real calendar slot. Retrieval runs over per-tenant knowledge bases on PostgreSQL with pgvector, covering chunking, retrieval tuning, and three interchangeable embedding providers behind one factory. The language model sits behind a provider-agnostic module with prompt caching on each tenant's knowledge base. Third-party systems connect through a shared connector registry.
Result: Running in production on AWS with FastAPI on Lambda, PostgreSQL on RDS, and infrastructure defined as code. Roughly 180 reviewed pull requests and 158 back-end test modules.
Mobile Release Automation With Artifact Verification
Solution: I built a command-line tool that reproduces the real release environment before building, inspects the built artifact rather than trusting a zero exit code, and rejects unsafe artifacts before upload. A check that cannot run reports itself as skipped, never as passed, because a doctor who reports green for a check they did not perform is the exact failure this tool exists to prevent.
Result: Verified releases to TestFlight and Google Play, each confirmed by an independent query against the store after upload rather than by the exit code of the upload command.
Flamingo WordPress Plugin | Open Source Contribution | 800,000+ Active Installs
https://wordpress.org/plugins/flamingo/I built a scheduled cleanup that removes spam messages via a WordPress cron job, defaulting to every 30 days, with an option to change the interval or disable it entirely. The default matters: it had to be safe for site owners who never open the settings page, while still leaving the choice with anyone who wants it.
The release is documented here: https://contactform7.com/2019/09/09/flamingo-21/
Education
Bachelor of Commerce Degree in IT | Business Finance and Taxation
University of the Punjab - Lahore, Pakistan
Certifications
Supervised Machine Learning: Regression and Classification
Stanford University & DeepLearning.AI | via Coursera
Skills
Libraries/APIs
WordPress API, WordPress REST API, WooCommerce API, Google Maps API, Node.js, REST APIs, jQuery, jQuery UI, Twilio API, TensorFlow, Pushwoosh, PyTorch, TensorFlow Deep Learning Library (TFLearn), Stripe, Stripe API, Scikit-learn, Keras, NumPy, Pandas, OpenCV, Matplotlib, React, BuddyPress, SQLAlchemy, OpenAI API
Tools
Capacitor, Adobe, Cordova Plugins, OneSignal, Claude, ChatGPT, Whisper, RingCentral, n8n, Zoom, Celery, SendGrid, Microsoft Teams, PhpStorm, Expo, Git, Terminal, WP-CLI, Claude Code, GitLab CI/CD
Languages
CSS, TypeScript, HTML5, CSS3, JavaScript, PHP, HTML, ECMAScript (ES6), Python 3, SCSS, PHP 7, PHP 8, Python
Frameworks
PhoneGap, Angular, Ionic, Bootstrap, Vanilla JS, NestJS, Django, Agentic Frameworks, LangGraph, Next.js, Django REST Framework, Laravel, Laravel 5, AutoGen, AWS Serverless Application Model (SAM), Django Channels, Alembic, React Native, CodeIgniter
Paradigms
Mobile Development, Agile, Scrum, UX Design, Microservices, Microservices Architecture, Automation, Model Context Protocol (MCP), Serverless Architecture, B2B
Platforms
MacOS, Google Chrome, WordPress Theme Design, WordPress, Android, iOS, WooCommerce, Twilio, Kubernetes, AWS Cloud Computing Services, Salesforce, Vercel, HubSpot, Linkedln, Linux, Unix, cPanel, Jupyter Notebook, Docker, AWS IoT, Amazon Web Services (AWS), Visual Studio Code (VS Code), AWS Lambda
Storage
MariaDB, MySQL, SQLite, Database Architecture, PostgreSQL, Redis, Azure Cloud Services, MySQL/MariaDB
Industry Expertise
Accounting
Other
PSD to WordPress, APIs, Web Host Manager (WHM), API Integration, Communication, Information Technology, Website Migration, WordPress Design, Front-end, Front-end Development, Custom Post Types, Contact Form 7, Community Development, Events, Ajax, Cordova, WordPress Plugins, WordPress Themes, HTML to WordPress, Full-stack, User Experience (UX), WooCommerce Subscriptions 2, Progressive Web Applications (PWAs), Full-stack Development, Technical Leadership, Push Notifications, Design, Web Push Notifications, Cursor AI, WordPress Theme Customization, Multisite Network Management, WordPress Security, AI-powered Plugin Development, Personalization, Database Optimization, Third-party Integration, Team Management, Machine Learning, Customization, Android Development, iOS App Development, Recommendation Systems, Artificial Intelligence (AI), Performance Tuning, Integration, Elementor, FastAPI, Data Analysis, Chatbots, Scripting, Data Analytics, Email Marketing, OpenAI, Data Science, Generative Artificial Intelligence (GenAI), ChatGPT API, Natural Language Processing (NLP), Data Visualization, LangChain, Supervised Machine Learning, Vector Databases, Pinecone, AI Agents, Agentic AI, Data Management, Workflow Automation & System Integration, ChromaDB, Salesforce.com Administration, AI Voice Agents, Cloud Telephony, ElevenLabs Solutions, Telephony, Anthropic, Gemini, Prompt Engineering, Workflow Automation, Supabase, Financial Planning & Analysis (FP&A), Supply Chain, Transportation & Logistics, Consulting, Supply Chain Management (SCM), Logistics, Supply Chain Optimization, LLM Orchestration, Multi-agent Systems, Multi-tenant Architecture, Web Application Security (Web AppSec), Release Engineering, Retrieval-augmented Generation (RAG), Software Engineering, Email, Email Deliverability, Architecture, Critical Thinking, Leadership, Mobile App Development, Mobile Apps, RESTFul APIs, Time Management, WebSockets, HubSpot CRM, Software Integration, LinkedIn Ads, Software Development, Software Development Lifecycle (SDLC), Back-end Development, Business Services, Finance, Large Language Models (LLMs), Advisory.Business Advisory.Corporate Finance, Financial Modeling, Financial Advisory, Advisory.Business Advisory.Valuation, Amazon Bedrock AgentCore, SDKs, Pgvector, AWS Secrets Manager, Infrastructure as Code (IaC), Dynamic Application Security Testing (DAST), Mobile Security, Product Security, IT Security Assessment, Threat Modeling, Identity & Access Management (IAM), Billing, Advisory, Business Advisory, Industry, VPS/VDS, Customer Support, OpenAI GPT-4 API, Terminal Servers, DNS Configuration, VPS, Supervised Learning, Regression, Classification Algorithms, AI Automation, System Design, GitHub Actions, RAG Architecture, Multi-tenant SaaS, AWS Identity and Access Management, Application Security, Build & Release Engineering, Cedar Policy Language, Deepgram
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
Share your needs
Choose your talent
Start your risk-free talent trial
Top talent is in high demand.
Start hiring