Access Control List Experts in Germany

• PROBLEM: GTM effort is guesswork across fragmented identities and channels, with no closed feedback loop.
• BUILT: Cost-pyramid engine (L0–L3): identity resolution across ~25k entities, explainable intent scoring, and a closed decision loop (propose → execute → evaluate → learn) with calibration.
• IMPACT: Shipped v1.3.1 with a live demo; 99% of operations resolve at the free L0 tier (CI-enforced); $0 to run without any API key.

• Architected the Yatta Integration Layer – a config-driven integration platform on Java 25, Spring Boot 4 (WebFlux), Temporal, gRPC and Kafka, enabling new third-party integrations (e.g. AVS fulfillment) via declarative JSON configs with zero code changes.
• Designed and implemented Tink integration with 0Auth IBAN verification to enhance fraud prevention and account validation workflows with Adyen payByBank.
• Architected and implemented an OpenFGA-based authorization model for centralized management of users, groups, and fine-grained access control in the vendor portal.
• Architected and led delivery of the Yatta API Gateway platform using GraphQL Federation, providing a unified enterprise API layer across distributed microservices with centralized authentication, authorization and request orchestration.
• Replaced NGINX + NLB with Istio service mesh and AWS ALB; rolled out WAF, OAuth (Cognito), IP whitelisting and RBAC across environments.
• Migrated CDC from Confluent Cloud connectors to a self-hosted Kafka Connect + Debezium stack, reducing operational cost by ~80% across multiple environments.
• Implemented the Transactional Outbox pattern with Debezium for reliable, exactly-once event publishing to Kafka with Avro and Schema Registry.
• Migrated dunning/payment-recovery workflows from Airflow to Temporal, achieving 99.9% reliability for settlement handling.
• Optimised Apache Airflow with deferrable sensors to handle 1000+ concurrent DAG runs without scaling the worker pool.
• Refactored a monolithic Terraform codebase into 3 modular projects, cutting deployment time by ~45%.
• Stood up full observability with OpenTelemetry, Tempo, Prometheus and Loki; automated dev/staging/prod with ArgoCD, Image Updater and Helm.
• Collaborated with product, operations and engineering stakeholders to define scalable platform architecture and integration standards aligned with long-term business and operational goals.

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Architected and deployed private cloud data platform on VMware vSphere, integrating Greenplum MPP, Apache Kafka, Kubernetes, and Apache Solr, and developed real-time ingestion pipelines with Kafka Connect and Schema Registry.
• Led Oracle Exadata to Greenplum migration, rearchitected data models, optimized storage, implemented RabbitMQ with Debezium for CDC, and deployed VectorDB for Generative AI.
• Designed and executed multi-cloud migration PoC across AWS, Azure, and GCP, defined KPIs for throughput, latency, and cost efficiency, executed bulk data transfers, validated analytics and streaming workloads, and delivered full-scale architecture recommendations.
• Assessed legacy on-premises infrastructure and designed modern cloud-native data platforms using Greenplum and containerized microservices, advising on scalability, disaster recovery, and high-availability.

Architected and maintained data products for renewable energy operations, covering wind turbine, grid-meter, and weather data. Built scalable ETL/ELT pipelines in Azure Databricks using Delta Lake (bronze/silver/gold layers) and processed data in various formats, including structured and semi-structured data. Contributed to a data quality framework supporting table and column documentation, outlier detection, and completeness metrics across all datasets within a data product. In addition, implemented a DORA KPI Databricks dashboard used across all data products. Optimized CI/CD processes in Azure DevOps to streamline deployment across development, test, and production environments.

Technology stack: Azure Databricks, PySpark, SQL, Delta Lake, Unity Catalog, Azure Data Lake, APIs, Dremio, Azure DevOps, YAML, Git, Databricks Workflows, Application Insights, Terraform, OpenAI API, Codex, LLM-assisted workflows

Independent, part-time open-source engineering focused on build-time tooling for Next.js, React, MDX, and JavaScript/TypeScript compiler pipelines.

• Built next-slug-splitter to optimize content-driven Next.js applications. It analyzes MDX content at build time, resolves component usage, and generates route-specific handlers so pages avoid sharing the full catch-all component bundle.

• Created supporting plugins and utilities for scoped MDX transformations, nested component dependency resolution, compile-time refinement, safe ESTree evaluation, and object-graph diffing.

• Own architecture, API design, implementation, automated testing, npm publishing, documentation, demos, and performance benchmarking.

Building blocks:

• remark-scoped-mdx: Context-aware AST transformations with nested scope isolation, typed component registries, and prop inference.

• recma-component-resolver: Dependency-graph analysis and selective component forwarding across nested MDX includes.

• recma-static-refiner: Build-time prop extraction, schema validation, derivation, and pruning.

• estree-util-to-static-value and object-graph-delta: Safe static evaluation and deterministic, cycle-safe structural diffing.

Tech Stack:

• Frameworks: TypeScript · Next.js · React · MDX

• Compiler tooling: Unified · Remark · Recma · MDAST · ESTree · ts-morph · esbuild

• Competencies: Static analysis · AST traversal and transformation · dependency graphs · code generation · schema validation · route and bundle splitting

• Tooling: Vitest · tsup · npm · performance benchmarking

• Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, vulnerability management policy, business resilience programme, risk governance plan
• Consolidation into an integrated emergency handbook (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table, and a formal approval structure
• Review of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with documented compensating control
• Review and documentation of NIS2 and HinSchG applicability, including the legal reasoning for non-applicability

agentic-engineer.online is my publicly testable live demo and at the same time the platform where I show my work. Originally created as a recruitment trial task, I have since continued to run it as my own demo, learning, and product project — on a Hetzner VPS behind a Cloudflare tunnel, through a multi-stage AI-orchestrated deploy pipeline with snapshot rollback. If a deploy step breaks, the system falls back to the last clean snapshot, the script is adjusted, the test repeated — empirical, test-driven, without hand tuning.

• Technically behind it: Python and FastAPI, an OpenRouter model cascade, SQLite persistence, and Cloudflare edge tuning.
• I am the developer and the strictest customer of my own AI work in one person — what started as a prototype has become a tool I use every day and against which I test my own products.

• Configured Topics, Microsites into rich content portal widgets, Content Library, landing pages and automated client portal data sync, reducing manual effort by 80% and elevating self-service engagement.
• Architected optimal display across devices and varying resolutions to enhance user accessibility and experience.
• Set up and customized Azure VM integration by utilizing Catalog Items, PowerShell scripting and workflow orchestration.
• Analyzed and translated business requirements into scalable solutions, leveraging ServiceNow scripting to enhance platform functionality and elevate user experience.

Key ServiceNow Skills: Service Portal, Widget Development, Catalog Items, PowerShell Scripting, Workflow Orchestration, Content Management.

PLANT-MY-TREE®-per-order

The application enables Shopify merchants to automatically place tree-planting orders for every incoming order. By integrating ecological contributions directly into the purchase process, the manual effort for tracking and billing reforestation initiatives is eliminated. The system increases transparency for end customers through real-time visualizations of the ecological impact directly in the storefront. The architecture is based on a modular monolith with Spring Boot in the backend and an integrated React app inside the Shopify admin area. The solution uses webhooks to capture order data in an event-driven way and integrates the weclapp ERP system for automated monthly invoicing. An app proxy mechanism provides dynamic statistics such as CO2 compensation and planted trees without any performance loss for the merchant shop.

Tasks:

• Design of the modular software architecture based on Spring Modulith to ensure high maintainability
• Development of the event-driven business logic for evaluating Shopify orders via webhooks
• Implementation of automated invoicing by connecting the weclapp REST API
• Building the frontend using React Router and Shopify App Bridge for native integration
• Design of the database model and implementation of the persistence layer with JPA/Hibernate and Prisma
• Integration of internationalization processes for global use in the frontend and email communication
• Automation of deployment processes using Docker and GitLab CI/CD

Project skills: Java 25, Spring Boot, Spring Security, Spring Modulith, Hibernate, JPA, REST API, PostgreSQL, Maven, Liquibase, React, TypeScript, React Router, Vite, Node.js, Prisma, Zod, Docker, Docker Compose, GitLab CI/CD, Shopify CLI, Shopify App Bridge, Polaris, weclapp, i18next, Lombok, Vitest

I designed and developed an AI-powered multi-tenant platform on Azure that transforms SAP process recordings into technical documentation, presentations and automated tests, processing over 15,000 process recordings for enterprise customers like Würth. I owned the architecture, the production releases and the DevOps setup. I also designed a multi-tenant system with SSO and role-based access on Azure. Implemented an MCP Server with Dynamic OAuth Authentication.

Main Tasks:

• Sprint planning and feature preparation
• Design the multi-tenant platform architecture (FastAPI, SQLAlchemy, PostgreSQL row-level security for tenant isolation)
• Develop AI pipelines with Prefect for transcription (Azure Speech API), document generation and SAP screen-recording analysis (Claude, gpt-4-mini)
• Design and implement an MCP server to expose tenant knowledge to LLM clients (Claude), with async retrieval and reranking
• Implement LLM cost tracking, rate limiting and client pooling for Anthropic/OpenAI/Azure OpenAI endpoints
• Set up CI/CD: Docker images to Azure Container Registry, GitHub Actions, Azure Static Web Apps, Alembic migrations in containers
• Manage production releases and execute live data migrations for enterprise customers
• Define engineering standards and architecture patterns for the team

Environment: Azure / Azure Foundry / Python / FastAPI / Prefect / React / PostgreSQL

• As-is assessment of the current network infrastructure and its documentation, including on-site inspections
• Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
• Planning of new copper and fiber optic cabling, including patch panels
• Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
• Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
• Additional support after the components go live (hypercare phase)
• Regular communication with project management and client stakeholders

As part of this project, the existing active network infrastructure was modernized and aligned for the future. The goal was to introduce a high-performance, secure, and scalable network and WLAN infrastructure, including a Network Access Control (NAC) solution to improve network security and central access control.

At the start of the project, a comprehensive requirements analysis was carried out, taking into account the technical, operational, and security-related needs of the clinic sites. Based on this, a technical tender was prepared for new switches, WLAN access points, and the NAC solution.

By successfully delivering the project, a modern, standardized, and secure network infrastructure was established that meets the growing demands for availability, mobility, and IT security in clinical operations.

Tasks:

• Support of the tender process, including technical evaluation of the offers and bidder assessment
• Lead and coordinate the entire project delivery
• Align the project process with internal stakeholders, business units, and the hospital IT team
• Manage external service providers during implementation and installation of the systems
• Monitor implementation, including quality control, project acceptance, and issue management
• Coordinate communication between hospital IT and external service providers during the NAC implementation
• Carry out escalation management for technical and organizational challenges
• Ongoing budget tracking as well as monitoring of project effort and additional costs
• Prepare decision papers on project changes, additional services, and risks for management

• Technical program ownership for the IPv6 migration at DRV RP and DRV BW, with a focus on migration planning, execution structure, and cross-functional technical coordination.
• Designed and implemented an operational control model with dashboard, action board, KPI portfolio, risk register, and decision index to translate technical topics into structured delivery artifacts.
• Coordinated technical groundwork for architecture and rollout across IPv6 addressing, segmentation, dual-stack target design, test-lab planning, and cross-team dependencies.
• Supported security and compliance-related requirements in the context of BSI, NIS2, and critical infrastructure, translating them into traceable evidence, risks, and management reporting.
• Achievement: Established a reusable intake-to-governance workflow for systematically capturing technical actions, risks, open issues, and evidence requirements.
• Achievement: Created an operational baseline for technical program execution with measurable KPIs, clear ownership, and transparent decision support.