Cloud Engineers in Germany

To achieve savings and optimize compliance, apps were restructured based on the mappings in identity management, restrictions were defined, and costs resulting from excessive usage were reduced in particular. Communication with stakeholders, validation of authorizations with users and technical implementation in the SAP FI/CO and Sourcing & Procurement modules generated significant added value for the group. This also included the relevant documentation for the audit.

• Modernization of a large-scale Java enterprise application*

The project is modernizing a complex enterprise application that has grown over many years. The existing Spring-based legacy system runs on Java 8, OSGi, and Eclipse RCP and is being gradually migrated to a modern, maintainable architecture with Java 25 and Quarkus.

Marcus works on analysis, architecture, refactoring, and implementation. One focus is on untangling historically grown structures and dependencies and on building a clean, sustainable Java and Quarkus technology stack.

Tools & technologies: Java 8, Java 25, Quarkus, Hibernate ORM with Panache, EclipseLink, OSGi, Eclipse RCP, Maven, JUnit, Mockito, REST, JSON, Git, Eclipse IDE, IntelliJ IDEA Ultimate, Jira, Confluence

• Optimizing and accelera­tion of our Gitlab CI pipeline

• Conceptual work for the PoC of the Zero Trust system

• Extension of the policy-engine backend in Go

• Extension of the policy-testing mechanism in Python

• Architectural design of the PEP component of Zero Trust

• Documentation of the product

• Technologies: Zero Trust, Go, Python, Gitlab CI, Docker, JWT, Domain-Driven Design

• Architected the Yatta Integration Layer – a config-driven integration platform on Java 25, Spring Boot 4 (WebFlux), Temporal, gRPC and Kafka, enabling new third-party integrations (e.g. AVS fulfillment) via declarative JSON configs with zero code changes.
• Designed and implemented Tink integration with 0Auth IBAN verification to enhance fraud prevention and account validation workflows with Adyen payByBank.
• Architected and implemented an OpenFGA-based authorization model for centralized management of users, groups, and fine-grained access control in the vendor portal.
• Architected and led delivery of the Yatta API Gateway platform using GraphQL Federation, providing a unified enterprise API layer across distributed microservices with centralized authentication, authorization and request orchestration.
• Replaced NGINX + NLB with Istio service mesh and AWS ALB; rolled out WAF, OAuth (Cognito), IP whitelisting and RBAC across environments.
• Migrated CDC from Confluent Cloud connectors to a self-hosted Kafka Connect + Debezium stack, reducing operational cost by ~80% across multiple environments.
• Implemented the Transactional Outbox pattern with Debezium for reliable, exactly-once event publishing to Kafka with Avro and Schema Registry.
• Migrated dunning/payment-recovery workflows from Airflow to Temporal, achieving 99.9% reliability for settlement handling.
• Optimised Apache Airflow with deferrable sensors to handle 1000+ concurrent DAG runs without scaling the worker pool.
• Refactored a monolithic Terraform codebase into 3 modular projects, cutting deployment time by ~45%.
• Stood up full observability with OpenTelemetry, Tempo, Prometheus and Loki; automated dev/staging/prod with ArgoCD, Image Updater and Helm.
• Collaborated with product, operations and engineering stakeholders to define scalable platform architecture and integration standards aligned with long-term business and operational goals.

Project: Design and implementation of an AI product for four business use cases

Project management for an AI project at a leading provider of large-scale catering and food services, where a production-ready AI product for four use cases was implemented together with an external development partner: automated briefings based on CRM and document data, voice-based capture and structuring of reports, detection and consolidation of duplicates in master data, and data-based market analyses. A key focus was a data-protection-compliant architecture that passed the internal IT security review and enabled production use.

• Translation of business requirements into clearly defined AI use cases with a focused product scope and clear value proposition
• Selection and evaluation of models and architecture options for text extraction, speech-to-text, and context enrichment from business systems, including LLM integration, function calling, and retrieval
• Development and implementation of an architecture with European hosting, data minimization, and masking of personal data as a prerequisite for approval
• Management of interfaces between business departments, IT, IT security, and the external development partner under restrictive data access conditions
• Coordination with the CIO and executive management levels on data access, risk assessment, and approval decisions
• Preparation for the transition to production use

Development and evolutionary further development of a highly available, cloud-native microservice and integration architecture for dealer and retail processes in the Porsche Car Configurator.

Responsibilities

• Development of Java-/Kotlin-based backend, API, and integration components (Spring Boot)
• Integration of internal and external systems via REST/OpenAPI, GraphQL, Apache Kafka, and AWS SQS (synchronous and asynchronous)
• Implementation of stable, high-performance communication and data flows in a cloud-native platform architecture
• Processing of structured data formats (JSON, Protobuf, GraphQL schemas) based on existing API patterns
• Performance optimization of distributed microservices with reduced response times and higher operational stability
• Technical tests (unit, integration, and API tests) as well as error analysis in production-like environments
• AWS Infrastructure as Code with Terraform and AWS CDK
• CI/CD automation (build, test, and deployment pipelines) with GitHub Actions
• AI-supported feature implementation (GitHub Copilot Agent)

Label: Kotlin, Java 25, Spring Boot 4, Protobuf, TypeScript, AWS, Terraform, CDK, Apache Kafka, AWS SQS, REST/OpenAPI, GraphQL, JSON, PostgreSQL, Docker, GitHub Actions, Maven, Gradle, JUnit, Mockito, Testcontainers

Conversational AI assistant for cloud infrastructure and security queries

• Designed FastAPI backend with multi-turn conversation handler, token budgeting, and context window management.
• Integrated Amazon Bedrock (Claude 3 Sonnet/Haiku); built RAG pipeline with MongoDB chat history and semantic search.
• Implemented Factory Pattern for modular LLM provider switching; reduced model onboarding effort by 60%.
• Reduced LLM inference cost by 35% through model tiering (Haiku vs Sonnet) and prompt/entity consolidation.

Tech: Python, FastAPI, Amazon Bedrock, MongoDB, Streamlit, Pydantic.

• Onboarded and conducted comprehensive documentation and system analysis to assess the existing data infrastructure, facilitating rapid integration and collaboration across functional data teams (modelling, processing, reporting).
• Collaboratively defined the architecture and project structure for a central data pipeline repository, including hierarchical standards, knowledge management strategies, and role-specific responsibilities, enhancing maintainability and onboarding speed.
• Evaluated and validated open-source data routing tools (Airbyte, Apache NiFi, Dragster) for ingest and sync requirements in retail analytics, including local benchmarking and error-state testing.
• Led the design and deployment of Airbyte in Kubernetes, creating customized Helm charts, securing secrets handling, and configuring Ingress with TLS and internal DNS routing, ensuring full API and UI accessibility.
• Troubleshot and resolved Ingress controller issues, iterating through multiple stages of debugging and testing, and documented setup and replication steps for scalable reuse.
• Mapped data models to ARTS standard, supporting schema alignment for ERP and reporting use cases, and coordinated review loops to align future data processing logic.
• Drafted strategic 1-pagers comparing MinIO, Pub/Sub, and routing architectures, providing technical guidance for architectural decisions and investment planning.
• Enabled secure access and authentication mechanisms, including initial evaluation for SAML integration, cluster-level configuration reviews, and service annotation improvements.

• Creation, maintenance and hardening of Kubernetes clusters employing Ansible and ArgoCD
• Keywords: Ansible, AWX, Kubernetes, NetApp, Prometheus, CI/CD ArgoCD, SSO, Fluent-bit, HAProxy, Calico, Keycloak, oauth2-proxy, SealedSecrets, kubeseal, Aqua kube-bench, CIS-Benchmarks, Aqua Trivy operator

Designed and developed an AI-powered automation platform using n8n to analyze social media niches, identify target audiences, and automate marketing strategy generation. The solution combined AI agents, workflow orchestration, and data analysis to automate research processes and generate data-driven insights.

• Designed and implemented complex automation workflows using n8n
• Developed AI-powered analysis agents for market and audience research
• Integrated multiple APIs and AI services into automated workflows
• Built automated market, competitor, and target audience analysis pipelines
• Leveraged Large Language Models (LLMs) for information summarization, classification, and prioritization
• Containerized and deployed the platform using Docker

Technologies: n8n, AI Agents, OpenAI APIs, Prompt Engineering, LLMs, Docker, Linux, REST APIs, Webhooks

• Design and build of a fully isolated AWS offline environment with no outbound internet access for running a browser-based business application
• Design and implementation of a proxy and response service that terminates all external application calls inside the VPC and serves them from locally stored content; identification of the actual communication needs through measurement-based DNS query logging
• Creation of architecture designs and decision papers including a comparison of options (Application Load Balancer with Lambda and S3, reverse proxy on EC2, private API Gateway) assessed by operational effort, cost, and availability
• Transfer of the solution and operations documentation previously available only for Azure to an AWS target architecture, including reassignment of all services and operational processes
• Automated rollout as Infrastructure as Code (Terraform, CloudFormation) with CI deployment via GitHub Actions, plus setup of private DNS zones and an internal certificate chain for operation without internet access
• Creation of architecture, deployment, and operations documentation and handover to the customer
• Build-up of a private cloud platform on OpenStack at provider TelemaxX with Terraform, including FortiGate HA clusters, FortiManager, and Kubernetes
• Introduction of Policy as Code (Open Policy Agent, Conftest) as well as development of MCP servers (Model Context Protocol) to connect AI assistants to operations and project tools

Successes:

• Made the business application fully operable without internet access for the first time; the cause of the loading error was narrowed down systematically to missing CORS headers after the likely certificate issue was ruled out
• Fully transferred an existing Azure concept to AWS and replaced the manually created environment with a reproducible, CI-based rollout

Technology stack: AWS (VPC, Application Load Balancer, Lambda, S3, Route 53 private hosted zones and Resolver query logging, IAM, CloudWatch, EC2, CloudFormation), Infrastructure as Code (Terraform, CloudFormation, Remote State), CI/CD (GitHub Actions with OIDC, Azure DevOps Pipelines), OpenStack, FortiGate, FortiManager, Kubernetes, Policy as Code (Open Policy Agent, Conftest), offline and air-gap architectures, PKI & certificates (internal CA, TLS, CRL/OCSP), DNS, network segmentation, Linux, Windows Server, Python, Bash, PowerShell, YAML, JSON, architecture design & decision papers, documentation (Confluence, Markdown), Generative & Agentic AI (Model Context Protocol, Agentic AI Coding Tools)

AI Platform Backend – Senior Developer

Brought in to design and build a backend for an AI platform from scratch, including multi-provider LLM orchestration and real-time infrastructure for AI influencer personas at scale.

Tasks and responsibilities

• Architecture and implementation of a multi-LLM orchestration layer with Semantic Kernel to integrate GPT-4 and other providers for core platform logic and AI influencer personas, reducing model-switching overhead by abstracting provider APIs behind a single interface.
• Design and development of a backend from scratch in C# / .NET 10, including domain modeling with DDD, a versioned RESTful API layer, and cloud infrastructure setup on Azure.
• Built a real-time chat infrastructure with Server-Sent Events (SSE), message persistence, and delivery guarantees for live operation of AI influencer personas at scale.
• Developed a media management service with integration of cloud object storage for upload and retrieval of influencer-generated content.
• Created an integration and unit test suite with data seeding for reliable regression testing across all core platform flows, significantly reducing production error rates.

Tools and technologies: C#, .NET, ASP.NET Core, Python, TypeScript, MySQL, Semantic Kernel, EF Core, Minimal APIs, LLM Orchestration, Prompt Engineering, Agentic AI, Generative AI, AI-Assisted Engineering, Claude Code, GitHub Copilot, Google Gemini, OpenAI API, Ollama, Redis, Azure, Azure Container Apps, Azure Database for MySQL, Docker, GitHub Actions, Clean Architecture, Vertical Slice Architecture, CQRS, Domain-Driven Design, REST API, xUnit, Integration Testing, Unit Testing, Jira, Confluence, Scrum

• Held direct line management responsibility for a team of 4 Platform Engineers — owning hiring, performance reviews, and career development — while establishing a shared engineering standards framework and coaching culture that accelerated delivery across client engagements.
• Led a team of engineers to architect a cloud-native voice AI system for a major inspection client, enabling 2,500 field inspectors to document work fully hands-free via real-time transcription and AI agents — eliminating manual data entry across 440,000 inspections per month and reducing per-user cost from $9 to $1. Stack: AWS (DynamoDB, S3, Transcribe, CloudFront, API Gateway, Bedrock), ElevenLabs, Claude.
• Led a team of engineers to automate multi-region Kubernetes cluster management for a global SaaS leader, reducing provisioning time from 3 weeks to under a day and eliminating 90% of configuration errors. Stack: EKS, Terragrunt, Python, Bash, ArgoCD.
• Accelerator - Cloud-Agnostic AI Platform: Architected and delivered a cloud-agnostic, Kubernetes-native platform as an accelerator, enabling multi-tenant, enterprise-scale management of self-hosted LLMs with concurrent deployment of multiple base models and dynamic LoRA adapter serving. Designed production infrastructure using open-source tooling (ArgoCD, Karpenter, vLLM, SGLang) with automated model lifecycle management, API security (Keycloak + LiteLLM), and cost-optimized GPU provisioning.

• Independently designed, developed, published, and maintained mobile games for iOS and Android.
• Implemented application architecture, gameplay systems, UI, monetization, analytics, and platform integrations.
• Managed the complete release lifecycle, including testing, store publication, production monitoring, and iterative improvements based on analytics.