Software Architect in Germany

• Industry: Insurance, Trade, IT
• Customers & Projects: Consulting and selling insurance and similar services
• Main tasks: Insurance consulting (health insurance, retirement planning, wealth building); commercial services, inside and field sales; sales data analysis and forecasting; customer consulting and support; opening a new sales headquarters for private and business customers; business development & innovation management; business use case development; process optimization; stakeholder management; team leadership and training; preparation and delivery of trainings;
• Technologies used: Microsoft Office 365, Microsoft Teams, Jira, Draw.IO, Camunda 8, Java (8, 17,21,25), Git, Spring Boot, Spring Batch, Spring Data REST, Spring Web, Spring Security, J-Unit, Playwright, Lombock, Vaadin, H2, PostgreSQL (16, 17 18), pgAdmin, Docker, LLMs, JasperSoft Studio, JasperReports

• Development of an agent-based governance platform for the automated assurance of EU AI Act compliance and ODA-compliant orchestration of AI services in complex enterprise environments.

• Design and implementation of an agent-based "Mission Control" framework (Aletheia Conductor) for autonomous state monitoring and process control.

• Development of "Compliance-as-Code" (CaC) solutions based on OPA/Rego for system-wide enforcement of regulatory guardrails.

• Integration of TM Forum ODA standards (TMF630, TMF622, TMF642) to ensure interoperability and standardization.

• Building a highly available event-driven architecture using Redpanda and CloudEvents v1.0 for near-real-time event processing.

• Implementation of an audit-proof "Evidence Chain" through cryptographic linking of trace logs in preparation for automated audits.

• Tech Stack: Java 21 (Quarkus Native), TypeScript (Next.js), Redpanda (Kafka API), CloudEvents v1.0, OPA (Open Policy Agent) & Rego, TimescaleDB, ZincSearch, Redis, TM Forum ODA, Git, GitHub, Clean Code Development, Like-C4.

• Developed a browser-based platform for Kubernetes no-code deployment and cluster management
• Developed a CLI in TypeScript to deploy resources in the cluster without leaving the browser UI.
• Implemented DevSecOps pipelines: image scanning, SBOM, policy enforcement, supply-chain security, and used Kyverno. Implemented IAM integration for the command-line utility tool.
• Designed role and permission models for Keycloak, OAuth/OIDC, and social login flows.
• Used LLMs to convert user intent into diagrams.
• Worked on integration with multiple sovereign clouds like StackIT, Hetzner, CIVO, UpCloud, plus public clouds like AWS, GCP, and Azure
• The technology stack includes Java, Spring Boot, Kubernetes, OpenAI, Kubernetes multi-tenancy using vCluster, Karpenter, RBAC for CLI, Helm, React

• Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
• Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
• Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
• Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
• Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
• Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.

Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin

Built an international e-commerce platform for a multi-vendor marketplace for digital assets from scratch. Designed and operated cloud native architectures at enterprise scale.

• Designed and operated a highly scalable microservice and serverless architecture
• Built the complete cloud infrastructure with Terraform + AWS CDK in AWS
• Provisioned ECS/EKS clusters (Fargate), Application Load Balancers (reverse proxy), and Lambda functions
• Observability & tracing with CloudWatch, DataDog, Prometheus, and Grafana
• End-to-end setup with DataDog (formerly AWS CloudWatch), Prometheus, and custom Grafana dashboards
• Integration of advanced metrics (including ORM mapper) and distributed tracing with Jaeger
• Robust backup and disaster recovery strategies
• RDS Postgres backups and hourly snapshots
• Read-only, asynchronously synchronized replicas with automated master failover in emergencies
• Minute-level rollback capability through versioned Docker images on ECS and Git-based CI/CD pipelines
• Created CI/CD pipelines with GitHub Actions for automated multi-stage deployments (Dev, Testing, Prod)
• Integrated Stripe for international payment processing
• Built a marketplace payment system with multiple parties and payout routines
• Used Algolia for high-performance real-time search of digital assets on the platform
• Federation of services with GraphQL and Hasura
• Later migration to GraphQL Mesh
• Test Driven Development (TDD) - unit, integration, and E2E testing with Jest, Vitest, and Playwright
• Used Next.js / React for modern frontend applications in the nx monorepo
• Enterprise security architecture & access control
• Integration of JWT tokens with Auth0, OAuth, OIDC, IP guards, BOLA protection, and secret vaults
• Authorization concepts with RBAC, ABAC, and native Postgres Row-Level Security (RLS)
• Built internal microfrontends with Retool for fast prototyping and operational business processes

Technologies: ABAC, AWS CDK, AWS CloudWatch, AWS ECS, AWS EKS, AWS Fargate, AWS RDS, AWS S3, Algolia, Auth0, DataDog, Docker, GitHub Actions, Grafana, GraphQL, GraphQL Mesh, Hasura, JWT, Jaeger, Java, JavaScript, Jest, Kotlin, Kubernetes, Monorepo, Next.js, OIDC, Playwright, Postgres, Postgres RLS, Prometheus, RBAC, Redis, Retool, Serverless, Stripe, Terraform, TypeScript, Vitest

Product:

• Built a production-ready AI platform for generating brand-aware marketing images and videos from product data, user requirements, and uploaded media.
• Own the platform architecture, technical roadmap, API design, security, deployment workflow, operational reliability, and model-provider strategy.
• Developed the core platform in .NET and built supporting AI and workflow prototypes in Python, applying language-independent API contracts and structured interfaces between services and model providers.
• Implemented reliable background processing with RabbitMQ, persisted workflow state, idempotent handling, retries, failure recovery, logging, secure storage, authorization, and credit accounting.
• Made pragmatic build-versus-buy and model-routing decisions based on reliability, latency, cost, and maintainability rather than novelty.

Agent Orchestration & RAG Systems

• Built and compared agent workflows using Microsoft Agent Framework, LangGraph, and LangChain, including tool use, conditional routing, clarification steps, state management, and hand-offs between agents.
• Implemented reusable .NET components for agents, prompts, tools, model providers, structured responses, and retrieval with pyvector, making it easier to change AI providers without rewriting the core workflow.

• Recurring problem in my own AI-assisted projects: requirements analysis, use cases, and architecture decisions can be created quickly with AI support, but remain difficult to follow and scattered across Markdown files – knowledge is lost as soon as it is no longer in the context window. arknet turns requirements engineering and architecture knowledge into structured, verifiable data instead of plain text: requirements, use cases, and architecture decisions form a consistently linked knowledge graph, traceable from requirement to architecture decision – queryable by both people and AI agents. Technically based on RDF/OWL and a custom MCP server.

• Result: Working MCP daemon, Docker image published automatically to GHCR, nine hexagonal modules, eleven ADRs (including an Open-Core licensing model). Requirements engineering and Ubiquitous Language hexagons are active. Public as a Community Edition under Apache-2.0 since 07/2026 (github.com/kogn-io/arknet), together with the Claude Code plugin and GHCR image; Open-Core model.

• Label: Java, Maven, RDF, RDF4J, OWL, SPARQL, Model Context Protocol, Spring AI, Docker, GitHub, Git, Claude Code, Obsidian, DDD, Hexagonal Architecture, ArchUnit, JUnit, AssertJ, Interface Development, Software Architecture, Continuous Integration, Knowledge Management

• Development of safety-related embedded software for a mobile machine on a Hydac TTC 2390 controller.
• Implementation in C with consideration of SIL 3 / ASIL D and MISRA-C:2025.
• Implementation of communication via CAN, CANopen, and J1939.

Standards, guidelines and norms: ISO 26262, IEC 61508, MISRA-C:2025

Technologies: C99, Hydac TTC 2390, Infineon TriCore Aurix TC397, Hightec C/C++ Compiler, PC-lint Plus, CAN, CANopen, J1939, MISRA-C:2025

• Optimizing and accelera­tion of our Gitlab CI pipeline

• Conceptual work for the PoC of the Zero Trust system

• Extension of the policy-engine backend in Go

• Extension of the policy-testing mechanism in Python

• Architectural design of the PEP component of Zero Trust

• Documentation of the product

• Technologies: Zero Trust, Go, Python, Gitlab CI, Docker, JWT, Domain-Driven Design

• Building a data integration platform for high, medium, and low voltage assets for contextual analysis of time series with master data from the SCADA control system (IEC 60870 104), INIS, and SAP.
• Responsibility for the architecture and implementation of the solution, as well as sparring partner for the Product Owner.
• Use of Kotlin, Spring Boot, Maven, TimescaleDB, PostgreSQL, liquibase, Elements IoT, Docker, Kubernetes, Grafana, Python, jupyter, and various API gateways.

• Ride-sharing and bus platform, live and fully functional. Backend with Spring Boot 4.1 on Java 21, PostgreSQL with Flyway, and Testcontainers integration tests. Hosted in my own AWS account (ECS Fargate, ALB, ECR, IAM Least-Privilege) with CI/CD via GitHub Actions and OIDC federation without static credentials. Development fully AI-supported with Claude Code, including custom skills and project-specific memory. Spring Boot · Java 21 · PostgreSQL · Flyway · Docker · AWS ECS/ALB/ECR · CI/CD · GitHub Actions · Claude Code

• Client: Prime Force Group GmbH

Technologies used: Java 25, Spring Boot 4, MapStruct, JSpecify, PostgreSQL, Redis, Liquibase, REST/OpenAPI, Apache Kafka, Apache Solr, OpenID Connect via IronGate/Keycloak, SAP Customer Data Cloud, JUnit, Testcontainers, Karate, Playwright, GitLab monorepo with CI/CD, Jenkins, JFrog Artifactory, FluxCD, Docker, Kubernetes on Azure, OpenTelemetry, arc42, Jira, Confluence

The Team Management Center is the new central platform of the DFB for planning, managing, and carrying out team activities for the national teams - from squad selection and training camps to communication with players, clubs, and legal guardians. The platform is designed for multi-tenancy for the DFB and regional associations; player, club, and master data are intentionally not copied, but connected at runtime via the DFBnet APIs.

I have been involved in the project continuously since the architecture and concept phase (Sprint 0) and work in a distributed Scrum team in two-week sprints. In addition to implementation, my focus is on architecture alignment, connecting the DFBnet interfaces, as well as code reviews and test automation as quality assurance in the team.

Focus areas:

• Development and implementation of the multi-tenancy concept (tenant model for the DFB and regional associations), including data model, access layer, and Liquibase migrations.
• Design of the person service and the search concept based on Apache Solr.
• Integration of the DFBnet APIs (player, person, and club search, club data), including authentication and synchronous master data synchronization.
• Hardening the integration through resilience patterns: separate read timeouts for each search path, correction of circuit breaker counting, limiting parallel requests, and a club cache to reduce load on the external system.
• Development of self-service endpoints for players (own activities, activity details, games), including an access concept for participants, as well as person documents and file uploads.
• Standardization of API design: OpenAPI annotations, nullability model via a custom ModelConverter, JSpecify migration of the DTOs, and documented API guidelines.
• Build and maintenance of Karate-based API and integration tests, integration tests with Testcontainers, test guidelines, and bug triage from the integration and reference environments.
• Code reviews via merge requests, architecture documentation according to arc42, and architecture decisions (ADRs) in Confluence.
• Automated deployment to the integration and reference environments, analysis of login and OIDC issues in combination with IronGate.

Status: ongoing - as of 08/2026 in Sprint 17, around 940 person hours worked; testable delivery to the integration environment every two weeks.

Embedded Analytics & AI-assisted BI

Design and development of an integrated analytics solution based on ASP.NET Core, Power BI Embedded, and LLM services to provide context-based business information.

Development of an AI agent with Function/Tool Calling for the secure orchestration of REST APIs, SQL data sources, and technical services within defined business processes.

Building automated BI workflows including workspace management, deployment processes, and scheduled refresh via the Power BI REST API.

Implementation of secure service-to-service communication with Microsoft Entra ID and Service Principal, and integration into existing enterprise system landscapes.

Technologies: ASP.NET Core, C#/.NET, Power BI Embedded, Power BI REST API, LLM API, AI Agents, Function/Tool Calling, Entra ID

• Developing a model-based AI where natural language is interpreted as formal relations.
• Natural language terms are not considered rigid but fluid and can be negotiated in a context so meaning resolves by iteratively specifying.
• Develops all kinds of model solutions.
• Backed by natural language and data annotation.
• Requirements to code and other solutions.