Cloud Consultants in Germany

Led the end-to-end integration and migration architecture for decommissioning SAP IS-U market communication and transitioning to Salesforce Marketing Cloud (SFMC) with E.ON IT Services — covering regulated EDIFACT market messaging, a three-phase data migration (transfer of market message inventory after cutover), redesign of market communication processes, and full GDPR and German energy-market compliance.

• Designed the three-tier target architecture (SAP IS-U → NScale B2B gateway → SFMC) processing 50,000–100,000 EDIFACT messages daily within sub-5-minute SLAs.
• Architected the three-phase data migration: 36 months of historical data, zero-loss cutover of in-flight market messages, and near-real-time CDC synchronization.
• Delivered secure, BDEW/GDPR-compliant integration (AS2/OFTP2, RFC/IDoc, REST APIs, OAuth 2.0, Azure AD, AWS S3) achieving >99.5% uptime, <0.1% migration discrepancy, and RTO <4 hours.
• Applied BPMN to model and optimize the market communication processes.

Technologies: SAP IS-U, NScale, Salesforce Marketing Cloud, EDIFACT, OAuth 2.0, Azure AD, AWS S3, BPMN, Jira, Confluence, Draw.io

• Create and lead roadmap forecasting of support opportunities, including colleague training, process design and improvement, and new hire onboarding.
• Collaborate seamlessly with cross-functional teams including Professional Services, Support, Product, Sales, and Solution Engineering.
• Manage business and financial KPIs in alignment with overall business objectives.
• Industrial IT & Data Integration: Implement, configure, and integrate OT/IT systems and data flows, connecting control-layer sources (DCS, PLC, SCADA) to historians, data platforms, and enterprise systems through APIs and standard interfaces.
• AVEVA PI & Historian: Configure, maintain, and extend AVEVA PI (PI Data Archive, Asset Framework, interfaces/connectors) to capture, contextualize, and serve real-time and historical operational data.
• Alarm Management: Support and optimize alarm management systems – e.g. Honeywell Alarm Management – including alarm rationalization, classification, and the analysis of alarm performance, critical alarms, and alarm floods.
• Connectivity & Protocols: Set up and troubleshoot industrial connectivity using OPC UA and OPC A&E, including the configuration of tunnelers / wrappers to bridge OT data sources securely and reliably.
• Production Data Flow: Ensure seamless, secure, and well-structured data flow across the industrial IT landscape, transforming raw operational data into meaningful information for operations and decision-making.
• System Support & Troubleshooting: Provide ongoing support for OT/IT applications, troubleshooting issues across networks, software, and data integrations to keep systems running efficiently.
• Knowledge Management & Best Practices: Contribute to internal documentation, best practices, and troubleshooting guides, and help continuously improve how we deliver industrial IT and data solutions.

Tools & Software: Aveva PI, Salesforce, Active Directory, Microsoft Dynamics 365, Jira, Microsoft, Scrum, DevOps, Docker, CI/CD, Jenkins, GitHub.

Stabilization of an Azure/.NET landscape in live operation.

• Architecture, DevOps, and operational readiness; technical decisions under time pressure
• Azure DevOps, monitoring, ETL/ELT, cloud security, FinOps, and data-mesh-related topics

Technologies: Azure DevOps, .NET, CI/CD, monitoring, FinOps

• Designed and moderated a NIS2 preparation workshop for RAS Reinhardt Maschinenbau GmbH and its IT service provider Catuno GmbH. Together with executive management and IT leadership, the current status was assessed, an initial GAP analysis was conducted and areas for action were prioritized based on ISO 27001.
• Developed an ISO-27001-based regulatory framework (ISMS) for NIS2 compliance, including a structured current/target GAP analysis, targeted improvement of the security maturity level and preparation of the organization for NIS2 audit readiness.

Financial services provider, >10,000 employees

• Entra ID: App Registrations, Hybrid Identities, group and permission concepts, Conditional Access, MFA, RBAC, and PIM.
• Azure IaaS/PaaS, Networking, Security, Governance, Monitoring, and automation with Bicep and PowerShell.
• Consulting and technical support for internal cloud projects.

• Short description: Lead a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations control while preserving the autonomy of decentralized business units within regulatory boundaries.

• Tasks and activities:

• Overall responsibility for the design, setup, and implementation of an enterprise-wide cloud governance structure (Azure), incl. target picture, roadmap, and operating model.

• Management of internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps) incl. decision-making and escalation management.

• Planning and facilitation of workshops on cloud strategy, governance principles, and the design of areas such as Identity, Connectivity, and Platform Management.

• Definition, implementation, and rollout of cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).

• Building a cloud governance framework aligned with the Azure Cloud Adoption Framework (CAF), incl. landing zone and guardrail concepts.

• Introduction of automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).

• Implementation of cloud security and compliance monitoring mechanisms as well as continuous improvement processes.

• Establishment and operationalization of FinOps in an enterprise environment (central and decentralized FinOps teams), incl. cost management strategies, reporting, and guardrails.

• Integration of governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).

• Implementation of access concepts incl. RBAC design and "break glass" mechanisms (emergency access) as well as certificate automation (ACME / step-ca).

• Achievements:

• Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud usage in a regulated environment.

• Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.

• Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).

• Significantly increased workload compliance for lift-and-shift migrations.

• Technologies used:

• Microsoft Azure Policy, custom policies.

• Terraform, OpenTofu, Terragrunt.

• step-ca (ACME).

• Entra ID.

• Azure Firewall.

• Azure networking, hub-and-spoke architecture.

• Azure vWAN (evaluation).

• Azure Front Door, Azure Application Gateway.

• Azure ExpressRoute.

• Azure Key Vault.

• NetBox.

• GitLab (on-premises).

• Infrastructure, concepts used:

• Cloud shared responsibility model.

• Hub-and-spoke connectivity / central shared services (from a hub-spoke context).

• Central governance with decentralized delivery (business unit autonomy with guardrails).

• Methods used:

• Scrum.

• Stakeholder management (C-level to engineering).

• Cloud governance, Azure Cloud Adoption Framework (CAF).

• DevOps, CI/CD.

• Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.

• RBAC, "break glass" concepts.

• ACME / certificate automation.

• GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.

Designed and developed an Azure-based AI and data platform transforming distributed project documents into searchable, structured knowledge for an enterprise AI assistant. Combined incremental document processing, hybrid keyword/vector retrieval, knowledge graph extraction, and conversational AI for Microsoft Teams and Microsoft 365 Copilot. Implemented Python document-processing pipelines for PDF, Word, Outlook and text files; Azure Cosmos DB lifecycle management; Azure AI Search; Azure AI Foundry and Azure OpenAI; identity-aware retrieval with Microsoft Entra ID; project authorization; a TypeScript Microsoft Agents SDK agent; Pulumi infrastructure; resilient scheduling, retry and diagnostic tooling. Technology stack: Python, TypeScript, FastAPI, Pydantic, Azure AI Foundry, Azure OpenAI, Azure AI Search, Azure Cosmos DB, Blob/Table Storage, Container Apps/Jobs, Service Bus, Key Vault, Entra ID, Docker, Pulumi, pytest, Microsoft Teams and Microsoft 365 Copilot.

• Onboarded and conducted comprehensive documentation and system analysis to assess the existing data infrastructure, facilitating rapid integration and collaboration across functional data teams (modelling, processing, reporting).
• Collaboratively defined the architecture and project structure for a central data pipeline repository, including hierarchical standards, knowledge management strategies, and role-specific responsibilities, enhancing maintainability and onboarding speed.
• Evaluated and validated open-source data routing tools (Airbyte, Apache NiFi, Dragster) for ingest and sync requirements in retail analytics, including local benchmarking and error-state testing.
• Led the design and deployment of Airbyte in Kubernetes, creating customized Helm charts, securing secrets handling, and configuring Ingress with TLS and internal DNS routing, ensuring full API and UI accessibility.
• Troubleshot and resolved Ingress controller issues, iterating through multiple stages of debugging and testing, and documented setup and replication steps for scalable reuse.
• Mapped data models to ARTS standard, supporting schema alignment for ERP and reporting use cases, and coordinated review loops to align future data processing logic.
• Drafted strategic 1-pagers comparing MinIO, Pub/Sub, and routing architectures, providing technical guidance for architectural decisions and investment planning.
• Enabled secure access and authentication mechanisms, including initial evaluation for SAML integration, cluster-level configuration reviews, and service annotation improvements.

Designed and developed an AI-powered automation platform using n8n to analyze social media niches, identify target audiences, and automate marketing strategy generation. The solution combined AI agents, workflow orchestration, and data analysis to automate research processes and generate data-driven insights.

• Designed and implemented complex automation workflows using n8n
• Developed AI-powered analysis agents for market and audience research
• Integrated multiple APIs and AI services into automated workflows
• Built automated market, competitor, and target audience analysis pipelines
• Leveraged Large Language Models (LLMs) for information summarization, classification, and prioritization
• Containerized and deployed the platform using Docker

Technologies: n8n, AI Agents, OpenAI APIs, Prompt Engineering, LLMs, Docker, Linux, REST APIs, Webhooks

• Led client projects end-to-end — from scoping and cloud strategy to sprint planning and stakeholder alignment
• Planned and implemented secure Azure Landing Zones using Infrastructure as Code
• Developed governance frameworks and cloud security controls tailored to enterprise environments
• Executed cloud readiness assessments and managed cloud migration initiatives from evaluation to handover
• Facilitated client workshops and agile ceremonies (sprint planning, backlog refinement, standups)
• Built internal Cloud Competence Centers to foster knowledge sharing and best practices across teams
• Development of a general Cloud Service Portal

Business and IT analysis as well as implementation consulting for an e-invoicing project (eInvoicing) for a state-owned bank

• Professional management and coordination of the external service provider
• Business support for the introduction and integration of an e-invoicing solution into existing system landscapes
• Design and validation of electronic invoice formats (XRechnung, ZUGFeRD), including business terms and business rules
• Definition and coordination of business validation logic, mandatory fields, and tax requirements
• Analysis and coordination of business edge cases together with business departments and the tax department
• Support with connecting invoice-generating systems as well as with integration and mapping processes
• Translation of business requirements into technical implementation requirements

• Lead AI readiness and process assessments across HR and Finance, identify automation opportunities, develop ROI business cases and translate findings into prioritized recommendations for executive decision-making.
• Built CloudMcFly's internal AI operating system in self-hosted n8n, with a 22-strong digital workforce across seven business functions and an estimated delivery capacity equivalent to three to five people. A separate document-classification workflow reduced manual HR ticket routing by 60%.
• Translate EU AI Act requirements into practical governance roadmaps and deliver "AI Driving License" workshops, strengthening leadership understanding of AI adoption and governance responsibilities.

AI Assistance and Target Vision for Partially Autonomous Energy Portfolio Management

Building an AI control layer directly on the up-to-date daily live portfolio of a large energy provider — not as an isolated pilot, but as an operational extension of the existing DB1 and portfolio management. The goal is the gradual development from assistance through monitoring/alerting to analysis agents with Human-in-the-Loop approvals, supplemented by a role-specific System of Engagement alongside the BI System of Record. At the same time, the business case, target vision and management pitch compared with static monthly reporting are being developed.

• AI control layer: Design and build on the existing live portfolio data product (several million contracts) — development stages assistance → monitoring/alerting → agents with Human-in-the-Loop approvals.
• LLM-supported data analysis: Semantic queries, SQL/tool integration and additional RAG components based on portfolio, plan-versus-actual and data quality data (Azure OpenAI, Snowflake), with drill-downs to individual contract level.
• Analysis agents: Multi-stage agents for variance and driver analyses of churn, price adjustments, volumes and procurement costs.
• Views concept: Role-specific interfaces for business units, management and C-level as a System of Engagement alongside the BI System of Record.
• Business case & pitch: Target vision and cost-benefit argumentation compared with static monthly reporting.
• LLM setup (privacy & security): Coordination with IT Security and Data Protection — EU region, data separation and approval processes.
• Agent architecture: Multi-stage agent pipelines (analysis → validation → summary) with documented data sources, tool calls, review steps and source references for each statement.
• Data foundation: Built on the up-to-date daily DB1 data product (Snowflake, dbt) — portfolio, plan-versus-actual and data quality metrics as the common basis for all AI analyses.
• Guardrails & evaluation: Evaluation and approval processes for LLM responses relating to management-relevant statements — test sets, metrics and human review.
• Prototyping & validation: Iterative validation of agent responses with the business unit — test question catalogue, feedback loops and response quality for each release.
• Roadmap & development stages: Detailed stages from assistance → monitoring/alerting → partially autonomous management, including transition criteria and governance for each stage.
• Integration: Integration into the existing BI and data landscape — BI remains the System of Record, while the AI layer provides interactive drill-down paths as the System of Engagement.
• Enablement: Enablement of business users — prompting guides, training and an operating model for ongoing use.
• Management: Coordination of business units, Data Engineering, IT Security and Data Protection.
• Change Management: Communication and expectation management with business units and management throughout the development stages.

Results:

• Built on an existing up-to-date daily data product with several million contracts
• Established an LLM setup coordinated with Data Protection and IT Security in the EU region, including data separation and approvals
• Defined three development stages through to partially autonomous management
• Designed role-specific views for business units, management and C-level
• Developed the business case and management pitch for the development stages
• Established an iterative response-quality validation process with the business unit
• Designed the operating model for assistance operations and initiated validation

Stack: Azure OpenAI, Azure AI Foundry, Snowflake, dbt, React, TypeScript, Entra ID, RAG, Agentic AI, analysis agents, Human-in-the-Loop, Prompt Engineering, LLM Evaluation, LLMOps, GDPR / EU region, Azure DevOps, Python, SQL, Change Management

• Specialized in designing and implementing robust, secure cloud solutions for critical client infrastructure.
• Expertise in Microsoft Intune environment with a strong focus on system hardening and comprehensive policy management.
• Architected NIST and ISO/IEC 27000 compliant Mobile Device Management (MDM) infrastructure tailored for an international government defense aerospace project.
• Performed an architectural role for an offline Microsoft Endpoint Configuration Manager (MECM) environment, ensuring NIST compliance while handling complex manufacturing infrastructure.