Microsoft Certified: Azure Administrator Associate (AZ-104)

Scope: Embedded as FP&A Data & AI Architect within the Finance function of a major European refrigeration manufacturer, leading the transformation of manual, fragmented financial reporting into an automated, governance-driven intelligence platform. Driving the shift from Excel-based controlling to structured data architecture, Power BI analytics, and AI-assisted financial operations.

Financial Data Integrity & ERP Governance

• Initiated and led GL vs. subledger reconciliation investigations, identifying and resolving structural mismatches between General Ledger and subledger data that had gone undetected prior to engagement
• Conducted asset analysis to identify items missing from General Ledger postings, surfacing gaps in fixed asset tracking and period-end completeness
• Validated SAP reports, establishing baseline data quality standards for Finance team consumption
• Established systematic SAP data validation framework ensuring ongoing integrity between ERP postings and downstream reporting outputs

Finance Reporting Transformation

• Designed and implemented a structured Transformation Project approach for converting manual Finance reports into fully automated processes
• Created and owns the Data Reporting Audit Log; a centralized tracking system capturing report owners, stakeholders, data sources, manual effort estimates, and automation opportunity scores across the Finance function
• Mapped the full reporting landscape identifying quick-win automation targets and strategic Power BI migration candidates
• Actively reducing manual Excel and PowerPoint dependency across FP&A workflows; replacing point-in-time snapshots with live, governed data models

Power BI & Analytics Enablement

• Introduced and presented Power BI as the strategic reporting platform to Finance leadership, building internal buy-in for the BI transformation roadmap
• Designed initial Power BI architecture aligned with SAP, Salesforce and Oracle data structures and FP&A reporting requirements
• Established report ownership, governance documentation, and data lineage standards enabling sustainable self-service analytics across the Finance team

Transformation Infrastructure & Collaboration

• Configured and deployed Jira as the transformation project management hub, establishing structured sprint workflows, backlog management, and progress visibility for Finance IT initiatives
• Proposed and initiated a dedicated FP&A Communication & Transformation Hub, a structured cross-functional forum aligning Finance, IT, and business stakeholders around the reporting transformation roadmap
• Positioned the Finance function as an active driver of data governance and digital transformation within the broader organization

Outcomes

• GL/subledger reconciliation gaps identified and investigation framework established within first two weeks of engagement
• Data Reporting Audit Log deployed; first structured inventory of Finance reporting landscape in company history
• Power BI transformation roadmap presented and approved by Finance leadership
• Jira-based project governance live; Finance transformation now tracked with full sprint visibility

Technologies: SAP FI/CO · Power BI · DAX · SQL · Excel (advanced) · Power Query (M) · Power Automate · VBA · Jira · Microsoft 365 · SharePoint · Salesforce (Sales Data) · Oracle HCM · Python

• Lecturer for the GenAI Track at Master School Institute of Technology
• Development of a full-stack AI application (React + Python/FastAPI) for automated supplier product imports with intelligent column and category classification (4-layer hierarchy), including human-in-the-loop validation

Financial services provider, >10,000 employees

• Entra ID: App Registrations, Hybrid Identities, group and permission concepts, Conditional Access, MFA, RBAC, and PIM.
• Azure IaaS/PaaS, Networking, Security, Governance, Monitoring, and automation with Bicep and PowerShell.
• Consulting and technical support for internal cloud projects.

• Development of an application suite for AppSource (7 apps) focusing on customs processing & compliance

• Project support for VMware/Active Directory
• Operational support for administration, process execution
• Creation and review of documentation
• Active Directory, Powershell, VMware VSphere 7, Confluence, Jira
• Windows Server 2016/2019/2022/2025 GUI/Core
• Concept and rollout of Windows Update Services (approx. 500 client/server systems) and takeover of a central WSUS gateway company-wide
• Takeover and redesign KMS/RDS systems company-wide

Projects:

Project: RWE – Development of a company-wide Zero Trust cybersecurity architecture (CITADEL) Role: Senior Enterprise Cybersecurity Architect / Zero Trust Architect Company: RWE AG Description: Concept and implementation of the strategic CITADEL cybersecurity target architecture at RWE, based on the Zero Trust architecture principle and aligned with regulatory requirements such as NIS2, ISO 27001 and company-wide security governance policies. The goal was to build a measurable, auditable and scalable security architecture with a strong focus on Identity Governance, compliance transparency and operational manageability. Responsibilities & Achievements:

• Zero Trust architecture design: Developed a company-wide Zero Trust reference architecture (Identity, Device, Network, Application, Data) including trust zones, control points and enforcement mechanisms according to NIS2.
• Identity & Access Governance (IGA): Designed and introduced IGA governance structures including role models, recertification processes, segregation of duties (SoD) and lifecycle management for identities and access.
• Security governance & KPIs: Defined and implemented security KPIs and metrics to manage Zero Trust maturity, identity risks and compliance at the management level.
• Compliance & reporting: Built standardized compliance reports and dashboards to support internal audits, external assessments and regulatory evidence (e.g. NIS2).
• Architecture & stakeholder alignment: Worked closely with Enterprise Architecture, IT operations and business units to integrate the CITADEL architecture into existing IT and security landscapes.
• Strategic security consulting: Advised programs and projects on Zero Trust compliance, identity centricity and regulatory requirements in the energy and critical infrastructure (KRITIS) environment. Technologies & Methods: Zero Trust Architecture, NIS2, Identity Governance & Administration (IGA), IAM, RBAC, SoD, Entra ID, SailPoint, Zscaler, Terraform / IaC, Policy as Code, security KPIs, compliance reporting, NIST 2.0, ISO 27001, Enterprise Security Architecture, governance frameworks, risk & control management

Project: Scalable AI Workbench Platform on Microsoft Azure Role: Cloud Architect & Engineer Company: Siemens Energy Description: Design, development and operation of a secure, modular cloud infrastructure to support Data Science, Machine Learning and AI applications for various engineering teams at Siemens Energy. Responsibilities & Achievements:

• Cloud architecture: Designed and implemented an Infrastructure-as-Code solution (Terraform) for automated provisioning of Azure resources (Resource Groups, Storage Accounts, Cosmos DB, Application Insights, networking, PostgreSQL Flexible Server, Azure Container Apps, Azure Container Registry).
• Developer portal: Used Backstage with custom frontend and backend plugins (Node.js, TypeScript, React.js, PostgreSQL, Container Apps) to enable self-service and empower developers, data scientists and AI/ML engineers.
• Role-based access control: Implemented Azure RBAC to grant targeted access (e.g. Storage Blob Data Contributor, Reader) to engineering groups (e.g. AI Engineers) for relevant resources.
• Data platform engineering: Built and configured a multi-layered storage landscape (Raw, Curated, Vector data), including automated container creation and access control for advanced analytics and AI workloads.
• DevOps integration: Integrated with Azure DevOps for CI/CD pipelines to automate deployment, monitoring and compliance.
• Security & compliance: Implemented Private Endpoints, network policies and Managed Identities to ensure data protection and regulatory compliance.
• Collaboration: Worked closely with cross-functional teams to align the cloud infrastructure with business and technical requirements and drive digital transformation at Siemens Energy. Technologies: Azure, Terraform, Azure DevOps, Cosmos DB, Application Insights, Azure Storage, Private Endpoints, Azure Synapse, Azure Machine Learning, Azure Entra ID, RBAC, Backstage, Node.js, React.js, PostgreSQL, Python (automation), Git

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Specialized in designing and implementing robust, secure cloud solutions for critical client infrastructure.
• Expertise in Microsoft Intune environment with a strong focus on system hardening and comprehensive policy management.
• Architected NIST and ISO/IEC 27000 compliant Mobile Device Management (MDM) infrastructure tailored for an international government defense aerospace project.
• Performed an architectural role for an offline Microsoft Endpoint Configuration Manager (MECM) environment, ensuring NIST compliance while handling complex manufacturing infrastructure.

• Consulting on the migration of email systems to Microsoft 365 Exchange Online
• Conducting end-user training & change management
• Goal: easier communication & collaboration in care operations

Technologies: n8n, Notion, OpenAI API, Claude, MS AI Foundry, MS CoPilot Studio, MS CoPilot, LLM, Node.js, Vercel, LangGraph, PostgreSQL, pgEdge, pgvector, Docker, LangChain, Ollama, Open WebUI

• Continuous evaluation and prioritization of internal automation needs
• ~20 AI agents in active use: research, content pipelines, document processing
• 5 n8n workflows for automated data and process control
• Architecture built on the same principles as in customer projects: state management, event-driven orchestration, API integration
• Ongoing operation and further development

• Designing processes for implementing regulatory IT requirements (VAIT, BAIT, DORA, MaGo) and establishing them within the IT organization
• Monitoring the execution of these processes, quality assurance and adaptation to new requirements
• Support and coordination of the annual audit regarding regulatory IT requirements (PwC)
• ITK governance
• Software lifecycle management
• Documentation and control of the IDV development process
• Process support and policy creation when setting up test management with regard to DORA and VAIT
• Policy creation for IAM processes
• Tools/Applications: ServiceNow, Confluence, Jira, M365, Loop, Connect, Omada

• Implementation of Infrastructure as Code (IaC) with Terraform to ensure a scalable, repeatable, and secure Azure infrastructure
• Implementation and optimization of CI/CD pipelines with Azure DevOps
• Management of container and server environments and AKS