Security Engineer in Germany

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

• Operation and further development of the network and security infrastructure.

• Monitoring, analysis and resolution of network and security incidents.

• Cross-department collaboration with other specialist teams for operations, further development and reporting.

• Firewall vulnerability analysis.

• Firewall rule approvals.

• Troubleshooting IP communication issues in the network and firewall infrastructure.

• Security-critical IT infrastructure, processing of personal data, compliance with legal regulations.

• Products: Palo Alto Networks Firewalls, Cisco ACI, Checkpoint Firewalls, F5

• Technologies: SDN, SDWAN, Cisco EPIC, Cisco ACI

Participation in the EU-funded MORANE-2 project to validate the Future Railway Mobile Communication System (FRMCS) in real-life use cases: creation of the requirement specifications for TOBA as well as the associated test specifications.

Technologies: 5GS (Radio & Core), FRMCS, MCx (MCPTT, MCData, MCVideo), MC Gateway UE, MCx Priority/Security/QoS Management, ETCS, SIP, IMS

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

• Advised the executive team on the strategy, architecture, and development of an AI-powered Product Security Operations Center (PSOC); a cybersecurity operating system for software-defined cyber physical connected systems.
• Provided strategic guidance on product vision, regulatory alignment, and market positioning, supporting capabilities across threat intelligence, vulnerability management, compliance automation, and autonomous product security.

Conversational AI assistant for cloud infrastructure and security queries

• Designed FastAPI backend with multi-turn conversation handler, token budgeting, and context window management.
• Integrated Amazon Bedrock (Claude 3 Sonnet/Haiku); built RAG pipeline with MongoDB chat history and semantic search.
• Implemented Factory Pattern for modular LLM provider switching; reduced model onboarding effort by 60%.
• Reduced LLM inference cost by 35% through model tiering (Haiku vs Sonnet) and prompt/entity consolidation.

Tech: Python, FastAPI, Amazon Bedrock, MongoDB, Streamlit, Pydantic.

• Support in building and further developing the information security management system
• Cooperation with external consultants in the certification team for the support structure
• Involvement in project planning, identification, and implementation of the necessary measures according to BSI IT baseline protection
• Professional support for in-house subject matter experts in creating the documents required for certifications
• Carrying out the work according to BSI 200-2

Support for Internal Audit:

Conducting an audit of the data protection officer and data protection management:

• Preparing an audit program based on the audit field concept
• Requesting the necessary audit documentation
• Carrying out control testing based on the audit program with the following focus:
• Reviewing the relevant PPS processes
• Reviewing the data protection mission statement, data protection policy, and data protection management concept
• Conducting audit interviews with the data protection officer
• Preparing the audit documentation
• Training a junior auditor in the methodology of Internal Audit
• Coordinating the audit documentation with the head of audit

• As-is assessment of the current network infrastructure and its documentation, including on-site inspections
• Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
• Planning of new copper and fiber optic cabling, including patch panels
• Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
• Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
• Additional support after the components go live (hypercare phase)
• Regular communication with project management and client stakeholders

• Set up Azure Kubernetes clusters (AKS) with network policies, security groups, and RBAC
• Developed Terraform-based infrastructure as code for secure, reproducible deployments in the BMW Azure cloud
• Hardened CI/CD pipelines using Jenkins, SonarQube, Fortify SSC, and Contrast AST
• Integrated SAP BTP/Kyma and ServiceNow GRC

• Codebase Evaluation & Problem Design: Designed and stress-tested complex software engineering problems against large open-source Python codebases (including pandas), requiring deep context acquisition and architectural understanding to produce well-scoped, realistic problem statements aligned to strict correctness guidelines.
• Agent Failure Analysis: Assessed LLM coding agent solutions for correctness and completeness, identifying meaningful failures across edge case handling, dtype behaviour, and multi-column NaN propagation logic; documented findings with precision for downstream evaluation use.
• Programmatic Test Suite Development: Authored comprehensive pytest suites to programmatically verify agent-generated solutions against defined requirements, with deliberate coverage of boundary conditions and failure modes not caught by naive implementations.
• Containerised Environment Engineering: Built and debugged Docker environments for reproducible agent execution, including git-based repository provisioning, dependency pinning with npm ci, and multi-stage Dockerfile authoring across Linux-based containers.

• Analysis and remediation of security vulnerabilities in a risk assessment system for energy trading
• System analysis
• Threat modeling
• Decision-making on vulnerability mitigation strategies
• Implementation of vulnerability detection mechanisms
• Security scans
• DevSecOps practices
• Technical environment: Visual Studio Code, JetBrains Suite, MS Threat Modeling Tool, DevSecOps, Git, AWS, DynamoDB, SQL Server, Endur, Snowflake, Orca
• Languages: C#, JavaScript, TypeScript, Python, PowerShell, Bash, Terraform, SQL

• Operation and further development of a SASE infrastructure based on Netskope

• Environment: AWS, Ruby on Rails, GraphQL, React Native
• Penetration test for Backend, Android-App and iOS-App