Solution Architects in Munich

Topics:

• Further development of the CRM system NKAM and technical separation of “direct” and “indirect” sales
• Redesign of the discount management area and outsourcing to another system.
• Designing numerous improvements on the wholesale side to reduce manual effort down to the level of user stories.

Sole owner of the design system for an enterprise corporate-decarbonisation platform; the role was created on joining. I own design intent, tokens, component contracts, documentation and governance — engineering owns implementation.

• Established design system practice where none existed: token architecture, component specifications, audits, documentation and governance, in an organisation that had shipped for years without a design team.
• Rebuilt the design-side source of truth — replaced an undocumented, individually modified purchased kit with a clean component library and rebranded theme, and mirrored code components into design so both layers finally describe the same product.
• Consolidated overlapping legacy components into single contract-driven components, replacing configuration sprawl with intent expressed at the type level.
• Audited the system quantitatively — token counts, adoption ratios, override density, local-component proliferation — converting "the system isn't working" into figures engineering could not dispute.
• Authored the proposal to migrate off Material UI onto owned, standards-based foundations: headless primitives, plain CSS with custom properties, W3C-format design tokens and a documented component library — scoped as a staged pilot on the highest-friction component to prove the model without functional risk.
• Built and presented the case to executive stakeholders, including direct answers to the objections raised by the specialists most invested in the existing stack.

• Built a standalone corporate IT environment — cloud strategy, network, AWS Landing Zone, security requirements, contract negotiations.
• Migrated all applications, helping the client avoid significant contractual penalties.
• Onboarded and managed int...

Internal systems with regulatory and security requirements could not be used directly by AI tools for incident triage, troubleshooting, and documentation search. The goal was to securely integrate these systems through MCP while preserving existing acce...

• Clarification of project objectives, scope and the target business vision for building the AI-based knowledge database.
• Derivation of the initial architecture and implementation strategy for the Zasterbot chatbot, including separation of the MVP and further development stages.
• Development of a target business vision for building a structured knowledge database and integrating a future chatbot.
• Derivation and prioritization of use cases for information retrieval and provision by the chatbot.
• Modeling of data structures and flows for the effective organization of the knowledge database on the Base44 platform.
• Design and implementation of data models for storing and linking relevant information.
• Development of processes for extracting, analyzing and preparing raw data for the knowledge database.
• Ensuring data consistency and quality as the basis for the future chatbot.
• Planning the integration of Large Language Models (LLMs) and Retrieval-Augmented Generation (RAG) for precise and context-specific answers.
• Implementation of functions for analyzing and displaying data from the knowledge database.
• Use of the Base44 platform with JSON Schema-based entities and a flexible permission concept.
• Implementation of Deno functions for backend logic, event processing and connecting external APIs.
• Integration of OpenAI services for initial data analysis.

• Redesign of a legacy Windows app for vehicle diagnostics as an AWS cloud application
• Creation of build pipelines and conducting code reviews with Kotlin, Spring Boot, Micronaut, Jenkins and GitHub

• Support in building a modern and secure microservice architecture
• Creation of architecture documentation
• Analysis and definition of interfaces with OpenAPI
• Knowledge transfer on architecture
• Support in frontend architecture
• Implementation of rule sets
• Hands-on work in backend and frontend

• Coordinating several Pega projects being part of CoE
• Participating in major architecture meetings
• Running LSA coordination meetings
• Providing guidance to the project teams
• Helping with technical issues resolution including performance problems
• Contributing to improving developers best practices and guidelines
• Providing expertise in ensuring high system availability
• Running PoCs
• Responsible for deployment pipelines implementation
• Individual targets rated over 100% every year

• About 800 different server VMs, operation and lifecycle/asset management of about 40 ESXi hosts (Lenovo)
• Upgrade of all clusters to ESXi/VCSA 7.0U3 and 8. Planning patch management for all hosts
• Cleaning up the AD – many different domains that all needed to be migrated into the main environment. Planning/execution
• Veeam – check the configuration and migrate to a newer, partly virtual infrastructure to make the setup leaner and faster
• VMware – upgrades/updates, general maintenance
• Proxmox POC – evaluate if an alternative to VMware
• Documentation for Veeam/VMware/storage
• Implementation of the uniflow cloud solution
• NetApp migration to new storage, CIFS maintenance and administration of SVMs

Conducted an independent technical assessment of an AI-enabled software platform, combining AI risk auditing, cybersecurity analysis and software architecture review. Reviewed application components, APIs, data flows, LLM integrations, retrieval-augmented generation, multi-agent orchestration, authentication, tenant isolation, dependency vulnerabilities, AI governance and model lifecycle controls. Authored a technical audit report with a structured risk register, source-code evidence, regulatory references, corrective actions, AI system inventory, risk classification, remediation roadmap and Key Risk Indicators.

Technologies: TypeScript, JavaScript, React, Next.js, Node.js, REST APIs, MongoDB, Redis, AWS serverless services, OAuth 2.0 / OpenID Connect, LLM APIs, RAG, vector search, multi-agent orchestration, Model Context Protocol, C4 architecture modelling, threat modelling, NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, OWASP guidance, MITRE ATLAS

Led the end-to-end integration and migration architecture for decommissioning SAP IS-U market communication and transitioning to Salesforce Marketing Cloud (SFMC) with E.ON IT Services — covering regulated EDIFACT market messaging, a three-phase data migration (transfer of market message inventory after cutover), redesign of market communication processes, and full GDPR and German energy-market compliance.

• Designed the three-tier target architecture (SAP IS-U → NScale B2B gateway → SFMC) processing 50,000–100,000 EDIFACT messages daily within sub-5-minute SLAs.
• Architected the three-phase data migration: 36 months of historical data, zero-loss cutover of in-flight market messages, and near-real-time CDC synchronization.
• Delivered secure, BDEW/GDPR-compliant integration (AS2/OFTP2, RFC/IDoc, REST APIs, OAuth 2.0, Azure AD, AWS S3) achieving >99.5% uptime, <0.1% migration discrepancy, and RTO <4 hours.
• Applied BPMN to model and optimize the market communication processes.

Technologies: SAP IS-U, NScale, Salesforce Marketing Cloud, EDIFACT, OAuth 2.0, Azure AD, AWS S3, BPMN, Jira, Confluence, Draw.io

• Overall responsibility for the project lifecycle from scope definition to completion
• Close collaboration with platform teams, IT leaders, and external service providers
• Application of SAFe principles and structured sprint work
• Creation of a migration roadmap with clear milestones
• Monitoring of the lifecycle: onboarding, repository migration, replication of permissions, and system tests
• Visualization of the architecture with PlantUML and Gliffy as well as documentation in Confluence
• Regular status reports and running knowledge transfer sessions

• Understanding of bank’s fundamentals throughout analysis and writing specifications

• Deep analysis of security measurements to be transferred into new environment

• Process design and optimization

• Collecting requirements from different areas and processing them into agreement documentation, concepts and process description for internal and external partners

• Analysis of data delivery sources and transformation of relevant functions into new environment

• Analysis and prioritisation of value and benefits resulting from introducing smart data tools

• Mapping and migrating data within Power BI upgrade

• Change management support and evaluation

• Marketing automation and technology enablement

• Executing test and release support

• Creating training documentation for the client’s employees to understand value and benefits by using new technologies when acquiring new or creating benefits to their existing customers

• Creating a complete database of existing firewalls supporting the security of the client’s infrastructure

• Migration and re-architecture of reporting systems from multiple data sources into the cloud environment

• Setup and configuration of an M365 tenant on a hybrid basis
• SSO integration of the existing app infrastructure like Metamost, Huhu, etc.
• License consulting, Entra ID initial configuration, MFA, Conditional Access, Privileged Identity Management
• Intune: initial configuration, Windows 11 Autopilot, iPhone AES
• Takeover of the tenant and preparation of a security audit
• Rollout of iPhones with AES (formerly DEP) as COPE (Corporate Owned, Business Enabled)
• Connecting external customers with enhanced security through Conditional Access
• Consulting on cloud-first strategy and migration to a cloud-only business
• Connecting various apps via SSO/SCIM (e.g. Atlassian, Personio, Adobe)
• On-premises AD: security audit and project management for replacing the local AD (migration of file servers, Navision2016, user clients joined to Entra ID)
• Copilot rollout with connection to external data sources and configuration via Intune
• Support for TISAX and ISO27001 preparation
• Setup and hardening of Entra ID, switching MFA to phishing resistant via Conditional Access
• Intune management for Windows and Apple clients, web enrollment switch to AES, introduction of Autopilot, app management, integration of Microsoft Defender
• Building a device baseline for Windows (COBO) and iOS/Android (BYOD)
• Teams/SharePoint Online: access concepts and integration into Teams
• Maintenance and backup of Entra ID and Intune tenants (drift management)
• M365 backup with Veeam
• Extending Conditional Access policies, introduction of Privileged Identity Management with hardware tokens and an on-premises admin tier concept
• Revision of existing GPOs regarding structure, security, and compliance
• Security audit and hardening of on-premises Active Directory and cloud tenant, SAML VPN, PIM introduction
• Support for the HR department in introducing a booking portal and general system engineering administration & security
• Introduction of Conditional Access and passwordless MFA, platform SSO, Defender for macOS/iOS, macOS compliance with Intune, Code2 signature configuration