DevOps Engineer

Refactoring and improving core APIs; implementing client change requests. Setting up metrics, traces, and logs monitoring infrastructure to support operations. Designing GitOps deployment and infrastructure as code. Applications and systems configuration in ArgoCD and Openshift. Confluence documentation of design, approach, and solution. Tech Stack: Java 8 & 21, Spring framework, JSP, JavaScript, Bash scripts, SQL, Grafana Stack, OpenTelemetry, Docker, DB2, Maven, Kubernetes Kompose.

• Interface role with the SOC team; improved incident response time by 45% through structured escalation processes and proactive security monitoring.
• Defined technical standards for a multi-tenant enterprise platform (10+ services), resulting in a 30% shorter onboarding time for new clients in the public sector.
• Active knowledge transfer and mentoring of a 6-person team; increased team autonomy and established a sustainable engineering culture.
• Reduced time to market by 50% by optimizing CI/CD pipelines and establishing self-service deployments.
• Stack: GitLab CI/CD, Kubernetes, Nexus, Harbor, ArgoCD, HashiCorp Vault, Grafana, Python, PostgreSQL, Java, Spring Boot, Flyway, Quarkus, JBoss, Loki, Go, Kafka, Kustomize, MongoDB

• Worked as freelance Senior DevOps Consultant on-site for IBM at a European Union Agency, operating in a highly secure, air-gapped environment managing classified systems.
• Led automation and DevOps initiatives for a large-scale OpenShift platform (>400 nodes), driving deployment efficiency, GitOps adoption, and operational automation using Ansible, Python, and Bash while ensuring compliance with security requirements.
• Spearheaded automation of release and deployment workflows in a private cloud environment hosting 400+ OpenShift nodes, significantly improving deployment speed and reliability.
• Migrated existing playbooks, roles, and templates from Ansible Tower to Ansible Automation Platform (AAP), ensuring full compliance with fully-qualified collection names (FQCN) and preparing custom Execution Environments (EE) for containerized automation.
• Implemented GitOps Agent for AAP Controller Configuration as Code, enabling automated synchronization (CRUD) of Ansible Controller objects based on repository-stored configuration definitions using GitHub webhooks.
• Designed and automated complex multi-step operational workflows including environment cleanup, Helix cluster component re-creation, Kafka topic management, and OpenShift object lifecycle management across ~100 environments.
• Achieved a reduction of multi-day manual operations to under a few hours through automation improvements spanning multiple AAP clusters and OpenShift environments.
• Integrated Ansible Automation Platform with Thycotic (Delinea) Secret Server via lookup plugin to enhance secure credential management in automated processes.
• Managed deployment tasks, platform troubleshooting, and Istio network configurations while adhering to stringent EU PSC security and compliance standards.
• Collaborated with infrastructure and application teams to refine deployment procedures, develop naming conventions, and continuously improve automation coverage in an air-gapped, classified environment.

Project goal: Introduce OpenShift as the run-time platform and migrate all applications to OpenShift.

My contribution: Make sure logging and monitoring for the applications were in place. Set up and put into operation the OpenShift components for logging and monitoring (Elasticsearch, Prometheus, and Grafana). Develop and implement the security concept for OpenShift. Work with developers to define and carry out the application changes needed for the OpenShift migration. Integrate monitoring into the applications.

Technical environment: Java, WebSphere Liberty, OpenShift components, Elasticsearch (ELK stack), Prometheus, Grafana.

• Main cloud solution architect on a banking SaaS offering hosted in Azure.
• Fully automated the Azure infrastructure in Terraform.
• Reduced cloud costs by 50%.
• Responded to incidents, found root-causes and closed with post-mortems.

• Kubernetes: EKS management, cluster upgrades and stability improvements, Infrastructure-as-Code reviews and updates, AWS support, and cost optimization.

• Architected and deployed a highly available, multi-tenant Kubernetes platform on Google Kubernetes Engine (GKE) for business-critical microservices.
• Designed and implemented a comprehensive Infrastructure-as-Code strategy using Terraform for managing GKE clusters, networking (VPCs, Subnets), and IAM policies.
• Engineered optimized storage solutions for stateful workloads (MongoDB) using GKE PersistentVolumes, enhancing performance and data resiliency.
• Established a full-stack observability framework using Google Cloud Monitoring, Logging, Prometheus, and Grafana.

• ZHAW CAS Secure Software Design and Development
• German C1 and Goethe Certificate C1
• ETH CAS Cloud and Mobile Computing at ETH Zurich
• Linux Foundation Linux System Administration LFS307
• Linux Foundation Kubernetes Fundamentals LFS258
• Linux Foundation Kubernetes for Application Developers LFD459
• Linux Foundation Kubernetes Security Fundamentals LFS460

• Architected the Yatta Integration Layer – a config-driven integration platform on Java 25, Spring Boot 4 (WebFlux), Temporal, gRPC and Kafka, enabling new third-party integrations (e.g. AVS fulfillment) via declarative JSON configs with zero code changes.
• Designed and implemented Tink integration with 0Auth IBAN verification to enhance fraud prevention and account validation workflows with Adyen payByBank.
• Architected and implemented an OpenFGA-based authorization model for centralized management of users, groups, and fine-grained access control in the vendor portal.
• Architected and led delivery of the Yatta API Gateway platform using GraphQL Federation, providing a unified enterprise API layer across distributed microservices with centralized authentication, authorization and request orchestration.
• Replaced NGINX + NLB with Istio service mesh and AWS ALB; rolled out WAF, OAuth (Cognito), IP whitelisting and RBAC across environments.
• Migrated CDC from Confluent Cloud connectors to a self-hosted Kafka Connect + Debezium stack, reducing operational cost by ~80% across multiple environments.
• Implemented the Transactional Outbox pattern with Debezium for reliable, exactly-once event publishing to Kafka with Avro and Schema Registry.
• Migrated dunning/payment-recovery workflows from Airflow to Temporal, achieving 99.9% reliability for settlement handling.
• Optimised Apache Airflow with deferrable sensors to handle 1000+ concurrent DAG runs without scaling the worker pool.
• Refactored a monolithic Terraform codebase into 3 modular projects, cutting deployment time by ~45%.
• Stood up full observability with OpenTelemetry, Tempo, Prometheus and Loki; automated dev/staging/prod with ArgoCD, Image Updater and Helm.
• Collaborated with product, operations and engineering stakeholders to define scalable platform architecture and integration standards aligned with long-term business and operational goals.

• Planning and implementation of IT infrastructures for clients
• Automating deployments with AWS CloudFormation and AWS CDK
• Monitoring and optimizing cloud environments and the entire IT infrastructure
• Providing technical support and troubleshooting infrastructure issues
• Collaborating with development teams on CI/CD processes

• PoC for various platform integration functionalities using Backstage and Crossplane
• Implementation of improvements of developer experience with Azure AVD and DevSpace
• Manage application deployment infrastructure on Kubernetes clusters
• Manage CI/CD platform
• Manage deployments into Kubernetes (Rancher and AKS) and into Azure
• Act as security champion of the DevOps team
• Manage vulnerabilities and support dev teams to manage third-party vulnerabilities using JFrog Xray
• Support building the platform team
• Manage infrastructure as code using Terraform and Atlantis
• Build and integrate a platform and IDP using Crossplane

IT consulting, analysis, architecture design, new and further development, code review, test automation, continuous integration, continuous delivery in backend and frontend areas for Automotive Project Instavalo.

Frontend:

• Implementation of UI components according to specifications, especially style guides and responsive design eith React and Typescript
• Component testing
• Code documentation
• CI/CD with Gitlab Pipeline

Backend / IoT:

• Analysis and architectural design with AWS Greengrass IoT on Edge Devices
• Setting up Microservices containers with Docker Compose on Edge device with AWS Greengrass and AWS IoT IAM, Token Exchange Service, Ansible
• CI/CD with Gitlab Pipeline, Terraform, AWS ECR
• Logging with Fluentbit Lua Language for AWS Cloudwatch
• Python Lambda for AWS Greengrass Recipe deployment on Edge Devices
• Implementation of test-driven development with JUnit, Mockito, and code Coverage
• Jacoco
• Definition of REST interfaces with OpenAPI / Swagger
• Development and enhancement of software based on Java Quarkus, Typescript NestJs NodeJs and Python
• Authentication and authorization in Aws IAM
• Development of REST and gRPC interfaces for the frontend and backend
• Implementation of Maven dependencies with DevSecOps OWASP
• Spring AI, Jetbrains AI Assistant, Junie, Github Copilot, Claude Code, Agents, Skills, Command, Hooks, Subagents

• Further development and ongoing maintenance of the existing WordPress site for EHF.at to revamp the responsive design and improve usability on mobile devices.
• Integration of WooCommerce into the existing site for full e-commerce functionality and digitization of the team sports apparel sales process.
• Implementation and configuration of an automated newsletter system to strengthen customer loyalty through regular updates and personalized offers.
• Ongoing maintenance including regular updates, performance optimizations, and security checks to keep the site up-to-date and functional.
• Project-related technical activities: PHP, CSS, and JavaScript.

• Implementation and maintenance of highly critical IAM solutions for B2B clients (SSO, MFA, SAML/OIDC, Entra ID, PIM/PAM)
• Security administration of Linux systems (CentOS, Red Hat) in Docker and Kubernetes environments
• Migration from Docker Swarm to Kubernetes
• Infrastructure automation with Terraform
• Planning and execution of risk assessments, threat modeling, and compliance reports
• Development and management of B2B applications (Java, REST/SOAP, Angular) and CI/CD pipelines (Python, Ansible, Jenkins, GitLab)
• Leading integration tests and UAT (Cucumber, Selenium, Katalon)
• Implementing monitoring and observability strategies with Grafana, Prometheus, and Splunk
• Integrating SAST tools like Snyk and SonarQube
• Release management and project coordination according to Scrum and SAFe
• Mentoring and technical support of junior team members