Cloud Engineers in Germany

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

Conversational AI assistant for cloud infrastructure and security queries

• Designed FastAPI backend with multi-turn conversation handler, token budgeting, and context window management.
• Integrated Amazon Bedrock (Claude 3 Sonnet/Haiku); built RAG pipeline with MongoDB chat history and semantic search.
• Implemented Factory Pattern for modular LLM provider switching; reduced model onboarding effort by 60%.
• Reduced LLM inference cost by 35% through model tiering (Haiku vs Sonnet) and prompt/entity consolidation.

Tech: Python, FastAPI, Amazon Bedrock, MongoDB, Streamlit, Pydantic.

• Onboarded and conducted comprehensive documentation and system analysis to assess the existing data infrastructure, facilitating rapid integration and collaboration across functional data teams (modelling, processing, reporting).
• Collaboratively defined the architecture and project structure for a central data pipeline repository, including hierarchical standards, knowledge management strategies, and role-specific responsibilities, enhancing maintainability and onboarding speed.
• Evaluated and validated open-source data routing tools (Airbyte, Apache NiFi, Dragster) for ingest and sync requirements in retail analytics, including local benchmarking and error-state testing.
• Led the design and deployment of Airbyte in Kubernetes, creating customized Helm charts, securing secrets handling, and configuring Ingress with TLS and internal DNS routing, ensuring full API and UI accessibility.
• Troubleshot and resolved Ingress controller issues, iterating through multiple stages of debugging and testing, and documented setup and replication steps for scalable reuse.
• Mapped data models to ARTS standard, supporting schema alignment for ERP and reporting use cases, and coordinated review loops to align future data processing logic.
• Drafted strategic 1-pagers comparing MinIO, Pub/Sub, and routing architectures, providing technical guidance for architectural decisions and investment planning.
• Enabled secure access and authentication mechanisms, including initial evaluation for SAML integration, cluster-level configuration reviews, and service annotation improvements.

Project: Concept and implementation of an AI product for four business use cases

Project management of an AI project at a leading provider of large-scale catering and food services, where a production-ready AI product for four use cases was implemented together with an external development partner: automated briefings from CRM and document data, voice-based capture and structuring of reports, detection and merging of duplicates in master data, and data-based market analysis. A central focus was a privacy-compliant architecture that passed the internal IT security review and enabled productive use.

• Translating business requirements into clearly defined AI use cases with a clear product scope and clear value proposition
• Selecting and evaluating models and architecture options for text extraction, speech-to-text and context enrichment from business systems, including LLM integration, function calling and retrieval
• Designing and enforcing an architecture with European hosting, data minimization and masking of personal data as a prerequisite for approval
• Managing the interfaces between business, IT, IT security and the external development partner under restrictive data access conditions
• Coordinating with CIO and executive management on data access, risk assessment and approval decisions
• Preparing the transition into productive use

AI Platform Backend – Senior Developer

Brought in to design and build a backend for an AI platform from scratch, including multi-provider LLM orchestration and real-time infrastructure for AI influencer personas at scale.

Tasks and responsibilities

• Architected and implemented a multi-LLM orchestration layer with Semantic Kernel to integrate GPT-4 and other providers for core platform logic and AI influencer personas, reducing model-switching overhead by abstracting provider APIs behind a single interface.
• Designed and developed a backend from scratch in C# / .NET 10, including domain modeling with DDD, a versioned RESTful API layer, and cloud infrastructure setup on Azure.
• Built a real-time chat infrastructure with Server-Sent Events (SSE), message persistence, and delivery guarantees for live operation of AI influencer personas at scale.
• Developed a media management service with integration of cloud object storage for upload and retrieval of influencer-generated content.
• Created an integration and unit test suite with data seeding for reliable regression testing across all core platform flows, significantly reducing the production error rate.

Tools and technologies: C#, .NET, ASP.NET Core, Python, TypeScript, MySQL, Semantic Kernel, EF Core, Minimal APIs, LLM Orchestration, Prompt Engineering, Agentic AI, Generative AI, AI-Assisted Engineering, Claude Code, GitHub Copilot, Google Gemini, OpenAI API, Ollama, Redis, Azure, Azure Container Apps, Azure Database for MySQL, Docker, GitHub Actions, Clean Architecture, Vertical Slice Architecture, CQRS, Domain-Driven Design, REST API, xUnit, Integration Testing, Unit Testing, Jira, Confluence, Scrum

• Held direct line management responsibility for a team of 4 Platform Engineers — owning hiring, performance reviews, and career development — while establishing a shared engineering standards framework and coaching culture that accelerated delivery across client engagements.
• Led a team of engineers to architect a cloud-native voice AI system for a major inspection client, enabling 2,500 field inspectors to document work fully hands-free via real-time transcription and AI agents — eliminating manual data entry across 440,000 inspections per month and reducing per-user cost from $9 to $1. Stack: AWS (DynamoDB, S3, Transcribe, CloudFront, API Gateway, Bedrock), ElevenLabs, Claude.
• Led a team of engineers to automate multi-region Kubernetes cluster management for a global SaaS leader, reducing provisioning time from 3 weeks to under a day and eliminating 90% of configuration errors. Stack: EKS, Terragrunt, Python, Bash, ArgoCD.
• Accelerator - Cloud-Agnostic AI Platform: Architected and delivered a cloud-agnostic, Kubernetes-native platform as an accelerator, enabling multi-tenant, enterprise-scale management of self-hosted LLMs with concurrent deployment of multiple base models and dynamic LoRA adapter serving. Designed production infrastructure using open-source tooling (ArgoCD, Karpenter, vLLM, SGLang) with automated model lifecycle management, API security (Keycloak + LiteLLM), and cost-optimized GPU provisioning.

• Independently designed, developed, published, and maintained mobile games for iOS and Android.
• Implemented application architecture, gameplay systems, UI, monetization, analytics, and platform integrations.
• Managed the complete release lifecycle, including testing, store publication, production monitoring, and iterative improvements based on analytics.

Building an observability and alerting solution for Business Central Job Queue monitoring

• Built a central monitoring solution to track the Business Central Job Queue in a multi-organization environment in Azure DevOps
• Integrated Azure Application Insights and Log Analytics for structured collection and analysis of job runtimes and error events
• Developed KQL queries for targeted analysis of failed jobs and detection of error patterns
• Connected Grafana and Power BI to visualize operational metrics and job status in real time
• Implemented an automated alerting workflow with Power Automate – when a job fails, a notification email is sent immediately
• Ensured transparency about the state of productive background processes during live operations

Result: Full transparency over failed Business Central jobs · Clear reduction in response time through automated email alerting · Stable foundation for proactive operation of productive background processes

Technologies: Azure DevOps | Application Insights | Log Analytics | KQL | Grafana | Power Automate | Power BI | Business Central | Azure Monitor

• Built an enterprise data lakehouse platform on Azure Databricks

• Developed production data pipelines and governance structures

• Implemented private cloud infrastructures using Terraform

• Introduced modern CI/CD standards in Azure DevOps

• Implemented secure IAM and governance concepts

• Developed scalable PySpark and Delta Lake frameworks

• Supported self-service analytics and data product approaches

• Provided architecture and platform consulting for enterprise data initiatives

• Built a central DataHub architecture for insurance data

• Integrated multiple subsystems into a lakehouse platform

• Introduced data governance and data lineage

• Supported modern analytics and reporting standards

• Optimized data delivery for business and analytics teams

• Modernized and modularized a legacy monolith to enable independent team workflows
• Migrated from Java 8 to Java 21 and from Spring Boot 2 to Spring Boot 3.3
• Simplified Maven project structure, reducing build time from 15 minutes to 50 seconds
• Converting architecture to a hexagonal DDD architecture with end-to-end integration tests using RestAssured and JUnit 5
• Tools and technologies: Java 8-22, Spring Boot, Mockito, AssertJ, RestAssured, Hibernate, OracleDB, Flyway, REST, JSON, Docker, Kubernetes, AWS, Bitbucket, GitHub, SonarQube, IntelliJ IDEA Ultimate

• Self-employed since 2008 in planning, developing, and supporting custom software, web, and system solutions for clients as well as my own projects.

• Complete technical implementation of projects — from requirements analysis and architecture to programming, release, maintenance, and further development.

• Development of database-driven web applications, customer portals, admin interfaces, ordering processes, user and permission management, and custom backend functions.

• Design and development of REST APIs, webhooks, microservices, and interfaces to reliably connect different applications and external services.

• Implementation of numerous smaller services and automations for data processing, monitoring, notifications, recurring tasks, and technical business processes.

• Development of Telegram bots with the Telegram Bot API, including automated notifications, user interactions, status queries, and control of technical workflows.

• Programming native Android applications in Java as well as developing my own games and interactive applications with Unity.

• Development, extension, and modernization of existing PHP, Java, JavaScript, and MySQL applications, including error analysis, performance optimization, and adaptation of grown codebases.

• Setup and support of Linux-based server environments with Apache and Nginx, as well as management of databases, domains, DNS, SSL certificates, email services, access rights, and backups.

• Development of browser-based automations with Selenium for data collection, checking, and processing of recurring workflows, reducing manual steps and making processes more reliable.

• Independent implementation of complete platforms and web projects, including devpraxis.de, hq-smm.com, and socialboost24.com.

• Many years of technical project support with responsibility for troubleshooting, maintenance, further development, documentation, and stable operation of production systems.

• Quick onboarding into existing applications and unfamiliar codebases to analyze technical problems in a structured way and implement practical, long-term maintainable solutions.

• Direct coordination with clients, clear explanation of technical topics, and independent implementation of agreed requirements.

• By combining software development, automation, and system administration, many tasks can be handled completely from a single source, which reduces coordination effort, technical dependencies, and processing time.

OpsWorker turns Kubernetes alerts into root-cause analyses, on top of the monitoring a team already runs. I lead the technical side: the agent architecture, the AWS infrastructure it runs on (fully inside EU regions), and the engineering decisions behind it, read-only in the cluster by default, human in the loop for judgment. The stack underneath: Amazon Bedrock and Bedrock AgentCore, agents built with the Strands Agents SDK, the Claude and OpenAI APIs, and the Kubernetes API.

Conceptual design and implementation of a modular customer portal based on Laravel.

The focus was on defining a maintainable system architecture with broad use of Domain-Driven Design principles (within the Laravel architecture), introducing automated quality assurance processes (test strategy, CI integration), and preparing an auditable operation (logging, traceability of changes) in an AWS-based infrastructure, taking IT security standards according to NIST and process requirements according to ISO 9001 into account.

Achievements:

• Analysis and structuring of business requirements in close coordination with stakeholders
• Documentation of the system architecture and infrastructure incl. change and release management
• Design and implementation of an interface for integrating SAP systems
• Planning and implementation of automated tests for quality assurance
• Implementation of security and compliance requirements, including SBOM generation, software license management, and QA processes
• Technical consulting and support for the internal IT team
• Introduction and establishment of AI-supported development processes (Spec-Driven Development), including AI-readable specifications, integration of AI instructions into the development environment, and training developers for productive use

Technologies and tools: SAP, Docker, ddev, PHP 8.4, Laravel, Filament, C4 Model, Architecture Decision Records (ADR), Mermaid, PlantUML, Spec-Driven Development, Claude, GitHub Copilot, Codex

• Delivered backend systems, data processing solutions, and software integrations for enterprise business applications.
• Designed and implemented API-based services connecting internal platforms with external systems.
• Built automated processing workflows to handle large-scale structured business data.
• Improved application performance by 30–50% through database optimization, caching strategies, and backend refactoring.
• Reduced manual operational effort by 40–60% by automating repetitive workflows.
• Supported production environments through troubleshooting, monitoring improvements, and continuous optimization.
• Authored technical documentation and led knowledge-transfer sessions to support long-term maintainability.