Professional Scrum Master I (PSM I)

Management of several MFA methods for centralized authentication within a group. Interface between various stakeholders such as support, financial accounting, developers, and security departments. Assessment of compliance requirements such as KRITIS. Budget controlling and monitoring of KPIs and SLAs. Support with internal and external audits on MFA and with connecting new systems. Review of operational documentation. Participation in steering committees and leadership of service review meetings and decision-making committees.

Tools/Frameworks: FIDO, YubiKey, Veridium, BSI IT-Grundschutz, NIST

• Generative AI products for corporate clients, owned from strategy through specification to production.
• Central strategy, local configuration: multi-tenant AI assistant for occupational pension schemes (bAV), delivered as an interactive avatar with text and voice path. Three tenants run on one codebase, each with its own conversation guide, while the knowledge base, guardrails and escalation paths stay central
• Versioned, AI-ready knowledge base composed into a tenant-agnostic voice context and tenant-specific text prompts — the configuration layer that keeps local adaptation from forking the product
• Conversational design: answer limits, scope and off-topic handling, anti-hallucination rules, escalation and lead handover to human advisors
• Five eval suites as a quality gate before any prompt or model change (anti-hallucination, LLM-as-judge failure modes, multi-turn consistency, voice KPIs, action vocabulary with confusion matrix); user test with 10 testers (Hamburg, 07/2026) drove the rework from alpha to beta
• Coordinated external developers, compliance and client stakeholders; GDPR-compliant EU stack, IDD-compliant, EU AI Act classification documented
• Second product line: white-label social media generator for consultancy chilli mind (CH/DE) — one codebase, per-client branding and configuration
• Results: 239+ deployments and a pilot with corporate customers · 108+ deployments for the white-label product · repeatable pattern for multi-tenant AI products in a regulated environment

Due to the steady growth of the client organization and the resulting increase in projects across various areas, including IT/digitalization, sales, organizational development and controlling, the demands on projects are increasing. Projects are often started but not completed within the planned timeframe, resources are not clearly assigned, and the business value is not clearly demonstrated. The objective of the assignment as Interim Head of PMO is to further develop and establish an existing project organization from the CDO area at executive management level. It is important that the governance is pragmatic, easy to understand and simple to apply in daily project work. The tasks and roles must be defined and established within the organization. In addition, this strategic PMO is to be supported by an IT solution, which must be selected and introduced. Furthermore, all ongoing projects are to be gradually integrated into the PMO governance and project management is to be centralized.

• Hands-on development of AI-native product prototypes with specialized AI agents for research, requirements, business logic, UX/flow design, test case generation and quality assurance.
• Structured use and orchestration of AI agents through clearly defined roles, inputs/outputs and handover points; breaking down complex product tasks into verifiable work packages and iterative prototyping cycles.
• Establishment of human-in-the-loop quality gates to validate AI-generated results for functional correctness, consistency, completeness and feasibility; targeted rework cycles in case of deviations.
• Development of a regulatory GenAI/rules prototype for CRD VI with a structured decision flow, web UI, rule-based validation and automated test cases; iteration of the business logic through to a pilot-ready POC.
• Design of an AI-to-Action banking prototype: AI intent → consent → bank/product logic → conversion including admin console; translating the product idea into MVP scope, role model, user flows and clickable prototypes.

• Requirements management, process planning, interface function, ISMS setup, and documentation
• Setup and establishment of an ISMS according to ISO 27001 and establishment of emergency management / ITSCM
• Coordination of the circumstances with the public-sector IT service provider
• Consideration of KRITIS relevance within the scope and implementation of a B3S
• Development of requirements for document control and the continuous improvement process
• Preparation of relevant project documents
• Analysis of existing processes and preparation of guidelines
• Requirements gathering for ISMS and ITSCM and coordination with the IT service provider, including definition of interfaces
• Analysis of communication processes and escalation paths
• Review of documents for risk management, ISMS, emergency preparedness, and emergency response
• Redesign of the complete documentation and preparation of new relevant documents
• Development of necessary rules, policies, and concepts
• Interface between customer and service provider to ensure document quality
• Coordination of protection needs with specialist departments, particularly regarding KRITIS relevance, and planning of resulting measures
• Development of preventive measures to minimize the risk of data center outages in scenarios such as pandemics or ransomware attacks
• Definition of the test strategy for IT emergency exercises
• Initiation of necessary awareness training measures for specialist departments
• External Information Security Officer
• Introduction of document control

• Built a scalable nearshore IT developer hub (Croatia, Czech Republic, Poland) as an independent company through a BOT model (Build – Operate – Transfer)
• Identified, selected, and managed full-service agencies; introduced management and control mechanisms, including KPIs, SLAs, and regular service reviews
• Prepared and reviewed data processing agreements and framework contracts in coordination with Legal & Compliance; integrated regulatory requirements (including KRITIS) into process design
• Advised on cloud vs. on-premise strategies, data storage, and authorization concepts; supported Procurement with tendering and service provider evaluations
• Managed change and process harmonization between internal teams and nearshore partners; reported to executive management, CFO, and CIO

Result: Scalable IT developer hub with an audit-ready governance model, reduced operating costs, and accelerated product development.

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

• SAP S/4HANA upgrade from Release 2021 to 2025 and FI/CO transformation as part of a new TOM. Four streams and two SAP service providers; management during ongoing operations.

• Overall responsibility for time, quality and budget as well as cross-stream coordination of the four streams

• Coordination of process streams, business functions and SAP service providers

• Establishment and management of governance, planning, risks, dependencies, resources and escalations

• Provider management, regular management reporting, and preparation and execution of project and Steering Committee meetings

• Responsibility as Test Manager for test strategy, test planning, UAT, defect management and acceptance

• Result: Successful preparation for Go-live on 28.09.2026 during ongoing operations; quality and the planned absence of production interruptions ensured. Project governance established and positive feedback from management and stakeholders.

• New development and further development of the existing MS Dynamics CRM

IT systems: Microsoft Dynamics Customer Service, SharePoint, DevOps, SAP IS-U

• CRM implementation / further development
• Taking over from the previous service provider
• Business process analysis
• Agile project organization
• Business analysis / requirements engineering with AI support
• Use of AI in development
• Analysis of master data processes
• CRM customer data management
• Requirements documentation
• Stakeholder management
• Workshop moderation

• Development of an agent-based governance platform for the automated assurance of EU AI Act compliance and ODA-compliant orchestration of AI services in complex enterprise environments.

• Design and implementation of an agent-based "Mission Control" framework (Aletheia Conductor) for autonomous state monitoring and process control.

• Development of "Compliance-as-Code" (CaC) solutions based on OPA/Rego for system-wide enforcement of regulatory guardrails.

• Integration of TM Forum ODA standards (TMF630, TMF622, TMF642) to ensure interoperability and standardization.

• Building a highly available event-driven architecture using Redpanda and CloudEvents v1.0 for near-real-time event processing.

• Implementation of an audit-proof "Evidence Chain" through cryptographic linking of trace logs in preparation for automated audits.

• Tech Stack: Java 21 (Quarkus Native), TypeScript (Next.js), Redpanda (Kafka API), CloudEvents v1.0, OPA (Open Policy Agent) & Rego, TimescaleDB, ZincSearch, Redis, TM Forum ODA, Git, GitHub, Clean Code Development, Like-C4.

• Project management for customer projects
• Requirements analysis
• Product Owner

In-house consulting provider and driver of transformation within the group, multi-stakeholder environment and C-level.

Realignment and stabilization of a cross-functional transformation and scaling program within the group. Sharpening the target picture, priorities, and set of measures, as well as building reliable governance, planning, and steering structures. Structuring roles, responsibilities, and strategic initiatives while including AI and IT automation ideas.

• Designed program realignment and project portfolio management

• Developed strategy model and target picture for IT projects

• Structured portfolio, roadmap, and priorities

• Established governance and regular meetings

• Worked out operating model for flagship projects

• Assessed AI and automation ideas

• Clarified roles and responsibilities

• Implemented change measures

• Developed, moderated, and evaluated workshops

• Transformed 17 initiatives into a steering model

• Increased transparency and decision-making ability

• Strengthened commitment in steering

• Sharpened the operating model structurally

• Integrated three top-5 institutes

• Involved over 80% of stakeholders

• Governance

• Portfolio steering (PPM)

• Change management

• Artificial intelligence

• Workflow automation

• AI use case assessment

• Confluence

• Jira

• Stakeholder management

• Developed business strategy, positioning, and market approach for a new B2B and B2C trading company.
• Designed and implemented the corporate website and online shop end to end, and coordinated suppliers and digital sales capabilities.