Real-Time Cost Intelligence at Ralph Lauren

Overview

Cloud cost overruns are usually discovered too late — in a monthly billing report, weeks after the spend happened. By then, the spike has compounded and the root cause is buried. This project put anomaly detection directly in the path of real-time spend data, so leadership saw cost problems as they emerged — not in a post-mortem.

Beyond cost intelligence, the broader engagement at this stage of my Ralph Lauren tenure also included a self-service IT platform serving 6,000+ employees and an end-to-end automation of user lifecycle and access management that reduced audit overhead by ~90%.

Problem Statement

Ralph Lauren's cloud spend was growing rapidly across AWS and Azure, but visibility tools were reactive — dashboards showed historical data, not live anomalies. Engineering and finance teams had no way to catch runaway jobs, misconfigured autoscaling, or unexpected usage spikes before they became expensive. Meanwhile, IT support was overwhelmed with manual, repetitive user requests that could be automated.

My Role

End-to-end delivery across three parallel workstreams: anomaly detection integration, self-service IT platform, and user lifecycle automation. Individual contributor with full ownership of design, build, and deployment for each.

Key Features

Cost Intelligence & Anomaly Detection:

• ML anomaly detection models running over real-time cloud spend event streams from AWS and Azure
• Live dashboards in AWS QuickSight and Power BI with cost spike alerts, root-cause attribution by service/team, and trend forecasting
• Threshold-adaptive alerting tuned per business unit to reduce false positives from legitimate spend patterns
• Executive-level summaries surfacing the highest-impact anomalies with recommended actions

Self-Service IT Platform:

• Web-based self-service applications for 6,000+ employees handling IT requests, access provisioning, software requests, and status tracking
• Reduced manual IT support ticket volume by ~37% within 2 months of deployment
• Integrated with existing ITSM tooling to route complex requests while resolving routine ones automatically

User Lifecycle & Access Automation:

• Automated provisioning and deprovisioning of user accounts and access rights across multiple enterprise platforms
• Replaced a slow, error-prone manual compliance process with an automated pipeline that ran on schedule and on trigger
• Audit overhead reduced by ~90% — compliance reports that previously required manual compilation generated automatically

TypeScript Integration Layer:

• Replaced fragile manual data handoffs between internal platforms with tested TypeScript scripts over REST APIs
• Made cross-platform workflows reliable and low-maintenance — no more broken pipelines from upstream format changes

Technical Architecture

• Anomaly detection: statistical and ML-based models (isolation forest, z-score with adaptive windows) over spend event data
• Dashboards: AWS QuickSight for real-time cloud data, Power BI for business unit reporting and executive views
• Self-service platform: web frontend, Python backend, ITSM API integrations
• Automation: Python scripts for lifecycle management, TypeScript REST API integrations for cross-platform data flows
• Infrastructure: AWS, Azure, with monitoring and alerting integrated into existing DevOps tooling

Challenges and Learnings

The hardest part of the anomaly detection work was calibrating sensitivity per business unit. A spend pattern that's anomalous for one team is completely normal for another. Generic thresholds generated too much noise; overly tight thresholds missed real problems. The solution was adaptive baselines per cost centre, trained on each unit's historical spend pattern, with human-in-the-loop feedback to improve over time.

The user lifecycle automation had a different challenge: enterprise identity systems are inconsistent across platforms, and deprovisioning in particular needed to be bulletproof — partial deprovisioning creates security vulnerabilities. Extensive testing across edge cases (role transfers, contractor offboarding, temp access grants) was essential before this went anywhere near production.

Outcome

$500K+ in annual cloud savings identified and actioned through real-time anomaly detection. Self-service IT platform reduced support load for 6,000+ employees by ~37%. User lifecycle automation cut compliance audit overhead by ~90%. These three workstreams collectively transformed how Ralph Lauren managed its technology operations — less manual, more visible, and more reliable.