About Expertise Experience Projects Contact

Hiba Rizvi

SDET | QA Lead
AI · Automation · Human in the Loop

I build multi-agent QA frameworks and LLM-evaluation pipelines for AI-driven distributed systems,
validating reasoning, not just outputs, with a human at every gate.

8+ Years Experience AI · Fintech · Insurance · Gov Karachi, Pakistan (open to relocation)
About

Quality starts at the
architecture level.

Most software teams treat quality as a testing phase. I've spent 8+ years proving it works better as a shared engineering discipline, embedded into requirements, system design, integrations, and user journeys before a single line of test code is written.

I partner with product, engineering, and design to ensure reliability is built in, not bolted on at the end.

My experience spans AI-powered workflow automation platforms, agentic orchestration frameworks, fintech and insurance products, event-driven architectures, and distributed backend systems across four industries.

AI Systems & Agentic Workflow Validation
Distributed Systems Reliability
Automation Architecture & CI/CD Integration
Quality Engineering Leadership
Product Strategy & UX Validation
0
Years of QA & Engineering Experience across SaaS, Fintech, AI & Insurance
0
Industries: AI Platforms, Fintech, Insurance, Public Safety
Emerging Field
Specialized in AI Quality Engineering, validating reasoning, not just outputs
Open Now
Available for relocation to EU, UK, UAE, US, plus senior remote roles globally
Core Expertise

What I bring
to your team

Technical depth across AI validation, automation engineering, distributed systems, and product strategy.

01

AI & Agentic QA

Multi-Agent Orchestration Human-in-the-Loop Gates Self-Healing Triage Automatic Test Tagging LangGraph RAG Knowledge Bases Prompt-Based Evaluation AI Safety
02

AI Evaluation & Observability

LLM-as-a-Judge Golden-Dataset Scoring Arize Phoenix (LLM Tracing) Grafana Pipeline Monitoring Deterministic Checks Trace Health
03

Quality Engineering

Test Strategy Risk-Based Testing End-to-End Testing Exploratory Testing Regression Automation Shift-Left Quality Page Object Model Release Readiness
04

Test Automation

Playwright playwright-bdd Cypress Selenium TestNG Cucumber / Gherkin JavaScript Python C#
05

APIs & Distributed Systems

REST APIs Postman Integration Testing Event-Driven Systems Async Workflows MongoDB SQL Data Integrity Fault Tolerance
06

Performance & Reliability

JMeter LoadRunner Performance Baselines Load Validation Scalability Testing Root Cause Analysis
07

DevOps & CI/CD

Git GitHub Actions Jenkins CI/CD Pipelines Docker Kubernetes kubectl
08

Product & Modern Tooling

Figma UX Validation Requirement Analysis Acceptance Criteria Claude Code Cursor GitHub Copilot Hugging Face
Professional Experience

Career timeline

8+ years across AI platforms, fintech, insurance, and digital evidence management.

Afiniti 2026 – Present
SDET Lead (AI)

Leading quality engineering for an AI-powered conversation intelligence platform built on distributed microservices and agentic orchestration workflows.

Built AI validation framework across 3 orchestration modules from greenfield
  • Established QA strategy and automation architecture for a new AI orchestration system
  • Designed agent validation scenarios using both real and synthetic interaction datasets
  • Validated distributed workflows: retries, state handoff, and fault recovery paths
  • Developed end-to-end simulations via Genesys Emulation Lab to mirror production load
  • Designed a 12-agent autonomous QA framework: human-in-the-loop gates, automatic test tagging, LLM-as-a-Judge evaluation, and a traces-style run dashboard (featured in Projects as AQA)
Beam AI 2024 – 2026
Senior SDET (AI)

Owned quality strategy for a no-code AI workflow automation platform enabling businesses to build and deploy intelligent agents at scale.

Reduced manual test cycles ~35% by introducing AI-assisted testing workflows
  • Defined end-to-end quality strategy and automation roadmap for the platform
  • Tested AI agent reasoning, decision-making outputs, and behavioral consistency
  • Validated complex event-driven integrations across 10+ third-party connectors
  • Ensured billing and usage system correctness through rigorous data validation
Finlex GmbH 2022 – 2024
Senior Software QA Engineer

Contributed to quality of commercial and industrial insurance platforms serving enterprise customers across European markets.

Achieved ~90% automated regression coverage across core insurance workflows
  • Built BDD automation frameworks with Cypress and Cucumber from scratch
  • Implemented API testing strategies across critical insurance integrations
  • Led regression, smoke, and UAT initiatives for major product releases
Hyperdata Computing 2019 – 2022
Software QA Engineer

Worked on digital evidence and asset management platforms used in secure, high-compliance environments requiring strong data integrity standards.

Maintained full traceability and coverage across all release cycles
  • Tested secure media processing, ingestion workflows, and chain-of-custody integrity
  • Validated APIs and storage pipelines against compliance and correctness requirements
Selected Work

Projects

Systems and frameworks I've designed and built end to end, from an agentic QA platform to cross-platform products and the backends behind them.

Agentic QA Framework
AQA Autonomous QA Agents

A 12-agent, human-gated framework that turns a scope link (an epic, story, or plain spec) into a merged, passing test suite (cases published, bugs raised with evidence, coverage recorded), with a human at five checkpoints, not an unattended robot.

Key Engineering Decisions
Designed 12 narrow, single-purpose agents: an 8-stage gated authoring pipeline (Scope Analyst → Test Architect → Case Designer → Tracker Publisher → Test Generator → Triage/Self-Healer → Reviewer → KB Curator) plus 4 async tracks (Performance, Drift, Design Parity, Eval), each with an explicit “does NOT” clause to prevent scope-bleed.
The live app is the only source of truth. Docs and designs drift, so every selector and behaviour is verified against the running app, never authored blind from a spec.
Dry-run by default, gated by humans. Nothing external (a ticket, PR, or merge) is sent without the matching gate and an explicit confirm; a 2xx is never “success”; the inner result is asserted. Never fake green.
Built a tag engine that auto-labels every scenario by @area and @type, making the suite pickable, so any subset runs on demand (--grep @area:checkout).
Shipped a traces-style “Runs Explorer” dashboard (a searchable data-flow board to inspect a run phase-by-phase), plus QA tracking of milestones, test cycles, and coverage, and a daily-report command.
Combined deterministic and LLM-based evaluation (knowing when a rule is enough and when to reach for a model) over a resumable orchestrator, so a run can pause at a gate and continue later.
Tech Stack
Testing
Playwrightplaywright-bddGherkin / BDDTag-based selection
Agents & Orchestration
Node.js (ESM)Human-in-the-loop gatesResumable pipelineReusable skills
Evaluation
Deterministic checksLLM evaluationSelf-healing / triage
Visibility
Runs Explorer (traces)Coverage trackingMilestones & cyclesDaily reports
12
Agents: 8 gated pipeline + 4 async tracks
5
Human gates (CP1–CP5), safe by design
2
Dashboards: traces flow + QA milestones/coverage
100%
Scenarios auto-tagged & pickable by area / type
Live at ferist.app
Ferist Collections of the Web

Collections of the web that open the way you meant them to. A link points at a resource but cannot bound one, so anyone handing another person exactly one thing sends a link and hopes. Ferist adds the missing primitive at the moment a resource opens, on-device, over content it never touches: playback state may change; resource identity may never change. One shared, RN-free core drives iOS, Android, Web, and a browser extension on a Go backend.

Key Engineering Decisions
Reduced the whole policy engine to one testable rule: playback may change, identity may not. Play, seek, speed, captions and fullscreen pass; next, autoplay, end-screen, related and in-page swaps are refused. The test is the action, never the site, so it holds on a provider it has never seen and does not decay when a platform redesigns.
Shipped three viewing profiles over one identical link: Full experience (no interception), Preview only (this resource and nothing else, including the page around the player), and Reader mode (page readable, every video element and embed removed before it can play).
Layered enforcement, because the dangerous failure is the silent one. Navigation is intercepted at the click, with a native URL-level guard behind it as a backstop: a block that fails loudly is recoverable, one that fails quietly is not.
Built a platform-agnostic shared core (@ferist/core) with types, viewer, sync engine, and platform ports, so one product contract drives four clients; platforms implement the ports, imports only flow downward.
Built and proved the offline-capture engine (complete and tested in the binary, not yet exposed to users): an in-path recorder tees the bytes the browser legitimately receives (including HTTP 206 range video) into a device-local store; replay serves local bytes or fails cleanly, never silently hitting the network. Coverage equals footprint (watch 30s of a 238 MB video, store only that).
Turned the web app into an offline-first PWA: a service worker precaches the shell + runtime-caches data, and an IndexedDB write-queue replays actions on reconnect via background sync.
Privacy by architecture, not by promise (ADR-009): content is fetched straight from where it already lives — Ferist is never in the traffic path, so no server anywhere holds a record of where anyone went. Captured bytes stay on-device; the backend stores metadata only, enforced by a CI guard that fails the build if a content column or upload path is ever introduced.
Defined Reader mode as a platform-independent contract gated by a single shared conformance suite, satisfied three ways (mobile inject, extension inject, and an SSRF-safe server-side transform with a sanitiser allowlist).
Hardened the backend: dual-transport auth (mobile Bearer JWT / web httpOnly cookies + double-submit CSRF → one principal), single-flight token refresh, statement_timeout + backpressure/load-shedding, and instant revocation via a Redis suspension check.
iOS App Store Readiness
Found that the native modules were never in the binary: the Xcode Sources phase listed only AppDelegate.swift, so offline capture and Keychain had never compiled while the build kept succeeding. Fixed and then verified by locating the RCTExternModule registration symbols per architecture in the built app — not by trusting a green build.
Caught a silent account-suspension failure: suspensions were enforced from a cache marker that nothing rebuilt from the durable record, so any deploy would have quietly lifted every active suspension while the database still showed them in force — moderator sees suspended, user sees a working app, nothing logs anything. Added a boot-and-timer reconciler plus four integration tests against a real database and cache.
Built the Guideline 1.2 UGC set: deterministic content screening (normalising leetspeak and punctuation tricks), reporting with auto-hide at threshold, an admin remove/restore queue, and blocking as mutual invisibility rather than a one-way mute, asserted from both directions because a half-working block fails silently.
Accessibility audited, not assumed. All 166 touchables checked for an accessible name; twelve were announced only as “button”. Running Dynamic Type at the largest size exposed a real barrier — the sign-in screen overflowed so that nobody needing large text could create an account. Root cause was a flex: 1 centred column across all four auth screens; now centred in a growing scroll view, with the flow committed as a regression test.
Removed an iOS location permission declared for a feature that does not exist and that contradicted the product’s own privacy policy — no geolocation dependency, no CoreLocation, no endpoint. Ships a PrivacyInfo.xcprivacy manifest with NSPrivacyTracking false and no tracking domains.
Universal Links association file returns 503 deliberately until the Apple Team ID exists: Apple caches that file aggressively, so shipping a placeholder would poison link handling for a long time. It becomes real with no code change.
Tech Stack
Mobile
React NativeTypeScriptSwift · WKWebViewKotlin · WebView
Web & Extension
Next.jsReactService Worker · PWAIndexedDB / OPFSMV3 Extension
Backend
GoPostgreSQLRedis
Architecture
Shared RN-free coreOffline-firstJWT + Cookie / CSRFADR-drivenConformance suite
4
Clients: iOS, Android, Web, Extension on 1 shared core
3
Viewing profiles: Full, Preview-only, Reader
0
Captured bytes on the backend, CI-guarded and metadata only
166
Touchables accessibility-audited to zero unnamed controls
Built Independently
Helix GO

A full-stack petrol station finder with real-time pricing, crowd intelligence, and routing, built with Flutter and a Node.js microservices backend.

Key Engineering Decisions
Designed a composite ranking algorithm that scores stations by distance (40%), price (35%), crowd level (15%), and queue length (10%), returning the single optimal stop, not a generic list.
Built a microservices architecture with five independently deployable services (station, discovery, crowd, price-history, user) coordinated through an API gateway with JWT auth and rate limiting.
Implemented real-time crowd enrichment using Promise.allSettled so crowd and pricing data enrich station results in parallel without blocking discovery on partial failures.
Architected a national price history API that aggregates per-station records by calendar day, computes moving averages, and derives trend direction, powering the 7-day price chart.
Built a ThemeExtension system in Flutter with 12 semantic color tokens and full light/dark support, so every widget reads from a single source of truth via context.appColors.
Station details screen generates brand-aware mock data (fuel types, engine oils, services) derived from station name heuristics, designed to be swapped for real API data once the backend schema is extended.
Tech Stack
Mobile
Flutter Dart Provider flutter_map Geolocator
Backend Services
Node.js Express.js Prisma ORM PostgreSQL Redis
Architecture
Microservices API Gateway JWT Auth Rate Limiting Haversine Distance
Features
Real-time Location Live Pricing Crowd Tracking Price History Dark / Light Theme
5+
Microservices designed & deployed
1
Composite scoring algorithm (4 signals)
7-day
Nationwide price history with trend detection
Full
End-to-end: mobile app to backend to database
Product Concept & Prototype
Sentri Contextual Device States

A product concept for intentional, contextual device states: a phone that instantly becomes a “driving phone” or “exam phone,” exposing only the world the moment intends. Explored philosophy-first and validated with a clickable transformation prototype.

Product & Design Thinking
Defined the product as a guarantee, not a mechanism (“the device exposes only the current world”), kept independent of platform, the same discipline as a security contract.
Froze a clean, defensible concept model: Template (preset) vs Environment (owned instance) vs Session (runtime), over a Policy/Capability configuration layer.
Prototyped the felt experience (the ~½-second metamorphosis when a phone “becomes” a driving phone) to test the emotional hook before committing to a build.
Designed to sit on top of the Ferist interception platform, and deliberately paused at the concept stage to prioritise shipping the core product: product judgement over feature-chasing.
Skills Demonstrated
Focus
Product visionConcept modellingUX prototypingInteraction designPrioritisation
Let's Connect

Ready to build
something reliable?

Actively exploring AI Quality Engineering leadership roles globally: senior IC, QA lead, or strategic quality roles at product companies building AI-powered systems.

Open to Global Relocation & Remote

Currently based in Karachi, Pakistan. Actively pursuing international opportunities, open to visa sponsorship and relocation.

Europe United Kingdom UAE United States Remote Global

Send me a message

I'll reply within 24 hours.

Message sent. I'll be in touch soon.