AWS Certified Security – Specialty

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Optimizing and accelera­tion of our Gitlab CI pipeline

• Conceptual work for the PoC of the Zero Trust system

• Extension of the policy-engine backend in Go

• Extension of the policy-testing mechanism in Python

• Architectural design of the PEP component of Zero Trust

• Documentation of the product

• Technologies: Zero Trust, Go, Python, Gitlab CI, Docker, JWT, Domain-Driven Design

• Creation, maintenance and hardening of Kubernetes clusters employing Ansible and ArgoCD
• Keywords: Ansible, AWX, Kubernetes, NetApp, Prometheus, CI/CD ArgoCD, SSO, Fluent-bit, HAProxy, Calico, Keycloak, oauth2-proxy, SealedSecrets, kubeseal, Aqua kube-bench, CIS-Benchmarks, Aqua Trivy operator

• AWS
• Genedata Profiler
• Data Lake
• APIs
• Rstudio
• GitLab
• Python
• R
• Data acquisition, integration, and simulation
• Multiplex immunofluorescence
• Copy-number variation calling
• HLA typing and loss-of-heterozygosity analysis
• RNA expression analysis

• Baseline compliance verification against MAS audit findings
• Building technical architecture concept for 30 technologies to build hardening standard artifacts
• Identifying and building automation possibilities for given technologies based on CIS
• Building the standard baseline configuration based on internal security standard
• Responsible for building Cloud Native Application Protection Platform (CNAPP) architecture artifacts based on Azure cloud platform
• Responsible for RFQ and RFP for different CNAPP solutions (Qualys Total Cloud, CrowdStrike, Azure Security Center)
• Supporting compliance verification and validation via automated scripts for a sample population of IT devices and instances
• Responsible for complete vulnerability management lifecycle using Nexpose, remediation, reporting and integration of results with Splunk, HPSM and Tableau
• Audit support for MAS

• Delivered AWS-authorized content through AAI program
• Facilitated group and 1-on-1 mentorship sessions
• Coached non-technical learners into cloud career paths
• Created learning materials aligned with AWS Skill Builder and AWS Academy labs

• Developed a custom tool using the Mistral 7B LLM to scan, validate and report security vulnerabilities.
• Security tested AI agents, bots, and other LLMs with a focus on prompt injection, model inversion, data poisoning, EDR/AV bypass and evasion techniques, membership inference, model evasion, overfitting to malicious inputs and contextual manipulation.
• Onboarded repositories to SAST solutions for security scanning, implemented secrets scanning, DAST, SCA, and utilized ZAP for DAST in CI/CD pipelines.
• Engaged in security awareness trainings, developed CTF challenges and training materials to enhance developer security knowledge.
• Planned and executed bi-annual red teaming operations based on the MITRE ATT&CK framework and led internal and external pentests based on the OWASP Top 10 framework for 70+ applications worldwide, resulting in detection, reporting, and remediation of hundreds of vulnerabilities.
• Triaged HackerOne reports.

• Co-authored enterprise cloud strategy including security and governance frameworks for 5 subsidiaries, and implemented part of the governance automation.
• Performed regular cloud cost optimization reviews across 10 teams resulting in ~20% cost reduction.
• Led the technology selection for the migration of in-house CIAM for 25M+ accounts to a SaaS solution, and worked with the product team through the migration.
• Supervised the technology selection and designed the architecture and delivery pipelines for the multi-tenant digital news and sports publishing platform, enabling ~250 editors within ~6 months of development start.
• Led the implementation of a multi-brand design system from idea and technical concept to implementation and rollout, enabling rapid UI prototyping for new products in a matter of hours.
• Managed a team of 4 architects and accelerated the professional growth of team members.
• Technologies: AWS cloud, Microservices, Docker, Python, Kafka, JavaScript, TypeScript, React.js, Node.js, GraphQL, REST, Gitlab CI, Visual Studio Code, git.

• Developed automated ETL pipelines with AWS Glue and Athena to ensure consistent data quality and governance requirements
• Implemented validation, anonymization, and encryption measures for data in compliance with GDPR
• Optimized cloud costs by introducing FinOps practices and increased transparency for business units
• Monitored performance, performed root cause analyses, and ensured adherence to SLAs
• Supported data and solution architects in building scalable data models for ML and analytics scenarios

• Designed 3 architectures to determine the most cost-effective solution regarding customer requirements
• Created the production and test environments from scratch
• Tech Stack: AWS (Serverless, CI/CD), GitHub