Active Directory Experts

• Automated Kubernetes deployments to over 400 customer target environments (Rancher/RKE2) using versioned Helm charts and Argo CD ApplicationSets for daily releases.
• Created self-service customer onboarding based on versioned runbooks, reducing the process from days to hours; coordinated with customer IT teams (AD/LDAP, SMB/DFS, network).
• Migrated selected services to AWS alongside the Open Telekom Cloud platform: provisioned VPC, EC2, and IAM roles with least-privilege policies using Terraform; operated workloads on EC2.
• Set up Keycloak realms and OIDC/SAML clients for product SSO, federated with customers’ Active Directory.
• Set up tenant-specific strongSwan IPsec sidecars on Kubernetes instead of a central transit VM, with keys in HashiCorp Vault: reduced connectivity costs by approximately 80%, with DFS indexing over the tunnel.
• Designed the high-availability migration of the Redis environment to managed OTC DCS; set up alerting and on-call rotations with incident.io by severity, and improved Grafana queries and indexing.

Designed a global SD-WAN / SASE solution (Paloalto Prisma Access or Cisco Secure Connect) and integrated it with the data center infrastructure (Cisco ACI, Cisco Catalyst/Nexus Switches, Cisco WLAN Controller, Cisco ISE)

• Led QA and test automation for a distributed industrial IoT and data-integration platform connecting shop-floor systems with enterprise applications.
• Designed and maintained automated API and UI tests using Playwright, TypeScript, and Python, covering REST APIs, authentication, resource management, integrations, permissions, and end-to-end workflows.
• Tested distributed services, data pipelines, messaging infrastructure, containerized applications, and integrations across Kubernetes, OpenShift, Docker, and Docker Compose environments.
• Performed functional, integration, regression, endurance, resilience, load, chaos, and exploratory testing across complex distributed systems.
• Used Chaos Mesh and Toxiproxy for network fault injection, latency, packet loss, and partition scenarios to validate system resilience and failure handling.
• Automated infrastructure provisioning, configuration, and environment setup with Ansible and managed deployments using Kubernetes and Helm.
• Tested integrations with industrial protocols, messaging systems, databases, HTTP/REST APIs, and external enterprise systems using simulators, emulators, and dedicated test environments.
• Worked with MQTT, Kafka, SQL databases, InfluxDB, REST APIs, OAuth 2.0, JWT, LDAP, Active Directory, OpenLDAP, mTLS, TLS, MFA, SSO, and RBAC.
• Investigated and resolved 40+ defects across backend services, integrations, distributed components, and web applications, using AI-assisted analysis with Claude to accelerate debugging, test design, and root-cause investigation.
• Improved deployment reliability through Kubernetes/OpenShift configuration and health-check tuning and monitored distributed systems using Grafana, Prometheus, and Loki.
• Collaborated with developers and product teams on sprint planning, technical refinement, quality strategy, release testing, and continuous improvement.
• Applied AI-assisted and agentic testing approaches to expand automated coverage and identify complex edge cases.

Goal:

Protect customer domains from spoofing by establishing and securing DMARC compliance, and ensure secure and stable operation of the Exchange and Microsoft 365 environment while keeping legitimate mail flows running smoothly.

Responsibilities:

• Project management, including reporting, customer coordination and budget responsibility
• Set up and secure DMARC, including DKIM and SPF
• Ongoing analysis of DMARC reports to detect and resolve issues early
• Replace EWS connections before Microsoft's shutdown on 01.10.2026 by switching to Microsoft Graph
• Introduce sensitivity labels in Microsoft Purview to protect sensitive information
• Automate recurring administrative tasks with PowerShell
• 3rd Level Support and ongoing administration of Exchange Online and Exchange on-premises

Technologies: Exchange Online, Exchange Server (on-premises), Microsoft 365, Microsoft Graph API, EWS, Microsoft Purview / Sensitivity Labels, DMARC, DKIM, SPF, RUA-Reporting, PowerShell, HCL Notes

At gematik's Cyber Defense Center (CDC/CERT) (critical infrastructure): Security Monitoring, Incident Response, and Service Monitoring for the telematics infrastructure (TI)

• Vulnerability management with Nexpose for gematik and the telematics infrastructure
• Vulnerability Assessment: Assessing and tracking vulnerabilities through Jira
• Security Monitoring and triage of security events with Splunk
• First Responder and Incident Handling: Initial assessment, triage, and escalation
• Service Monitoring: Monitoring critical TI services
• Documenting runbooks, playbooks, and knowledge base articles in Confluence

• Architected, Deployed and Supported hosted email solutions in Linux and Windows environments with enterprise-grade anti-spam and security architecture for service-provider environments.
• Managed Microsoft Azure environments including Virtual Machines, VNets, Storage, VPN, and Firewall configuration.
• Administered Microsoft Exchange Server (2010-2019), Microsoft Exchange Server SE, Active Directory, PKI, Hyper-V and Zimbra environments with disaster recovery planning and operational support.
• Led Microsoft 365 onboarding and migration projects from Exchange, IMAP, and Zimbra platforms to Microsoft 365.
• Prepare security and compliance to support Microsoft 365 Copilot.
• Implement information protection and data loss prevention by using Microsoft Purview.
• Implement retention, eDiscovery, and communication compliance in Microsoft Purview.
• Integrated Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and Active Directory Federation Services (AD FS).
• Delivered secure hybrid infrastructure solutions integrating Microsoft Windows Server and Linux-based enterprise environments.
• Supported enterprise integration projects involving Debian, Ubuntu, CentOS, Red Hat, Barracuda ESG, Qmail and Zimbra Platforms.

MOVE-ZPD – Strategic Infrastructure Project | Total Program Budget 48 Mio. € | Data Center Migration Hannover → Hamburg

Responsibility for a central subproject for migrating business-critical specialist applications to a highly available data center architecture.

• Management of a central subproject for migrating business-critical specialist applications to a highly available data center architecture.
• Independent management of around 30 of approximately 100 business-critical specialist applications, including Exchange (approx. 30'000 users), LDAP, DNS and cross-state applications.
• Management of project structure, milestones, dependencies, risks and escalations, as well as coordination of the required business and technical stakeholders.
• End-to-end coordination of the managed migrations, from planning and structuring through environment provision, testing and acceptance to production deployment and go-live.
• Stakeholder management between business units, Product Owners, data center operations, program organization and external service providers.
• Development and implementation of a standardized server request and change process to speed up VM provisioning and reduce manual coordination.
• Management reporting as well as preparation and moderation of steering and decision-making bodies and workshops.

Technologies & Tools: MS Project, MS Teams, SharePoint, Oracle APEX, CA Automation Manager, Visio, MindManager

• Create and lead roadmap forecasting of support opportunities, including colleague training, process design and improvement, and new hire onboarding.
• Collaborate seamlessly with cross-functional teams including Professional Services, Support, Product, Sales, and Solution Engineering.
• Manage business and financial KPIs in alignment with overall business objectives.
• Industrial IT & Data Integration: Implement, configure, and integrate OT/IT systems and data flows, connecting control-layer sources (DCS, PLC, SCADA) to historians, data platforms, and enterprise systems through APIs and standard interfaces.
• AVEVA PI & Historian: Configure, maintain, and extend AVEVA PI (PI Data Archive, Asset Framework, interfaces/connectors) to capture, contextualize, and serve real-time and historical operational data.
• Alarm Management: Support and optimize alarm management systems – e.g. Honeywell Alarm Management – including alarm rationalization, classification, and the analysis of alarm performance, critical alarms, and alarm floods.
• Connectivity & Protocols: Set up and troubleshoot industrial connectivity using OPC UA and OPC A&E, including the configuration of tunnelers / wrappers to bridge OT data sources securely and reliably.
• Production Data Flow: Ensure seamless, secure, and well-structured data flow across the industrial IT landscape, transforming raw operational data into meaningful information for operations and decision-making.
• System Support & Troubleshooting: Provide ongoing support for OT/IT applications, troubleshooting issues across networks, software, and data integrations to keep systems running efficiently.
• Knowledge Management & Best Practices: Contribute to internal documentation, best practices, and troubleshooting guides, and help continuously improve how we deliver industrial IT and data solutions.

Tools & Software: Aveva PI, Salesforce, Active Directory, Microsoft Dynamics 365, Jira, Microsoft, Scrum, DevOps, Docker, CI/CD, Jenkins, GitHub.

• Applied modern JavaScript features, including ES6+ syntax, destructuring, modules, array methods, and asynchronous programming, to develop efficient and readable frontend code.
• Implemented frontend integration patterns for PHP and Laravel backend services, connecting React interfaces to REST APIs and handling structured JSON data.
• Developed interactive, functional component-based frontend applications using React Hooks, JavaScript, and TypeScript, alongside backend applications and RESTful APIs using Python, Django, Flask, and FastAPI, focusing on reusable components, modular architecture, maintainability, and efficient data processing.
• Maintained a dynamic portfolio platform using PHP, Laravel, Livewire, and MySQL, implementing end-to-end functionality across frontend interfaces, backend services, and database operations.
• Validated server-side request handling, routing, middleware, and form validation using Laravel features to support reliable application workflows and consistent data processing.
• Designed and managed relational database structures using MySQL and Laravel Eloquent ORM, implementing data models, relationships, database migrations, and efficient queries for content management.
• AI-powered applications integrating Large Language Models (LLMs) through external APIs and locally hosted models, exploring practical use cases for conversational AI, intelligent automation, and AI-assisted workflows.
• Built local AI applications and developer tools for running, configuring, and interacting with locally hosted language models, gaining experience with local inference, model integration, and privacy-conscious AI workflows.
• Explored Retrieval-Augmented Generation (RAG) approaches to combine language models with external knowledge sources, enabling context-aware responses based on relevant application data and retrieved information.
• Integrated AI services with backend APIs and application components, developing reusable modules for model communication, response processing, error handling, and data exchange.

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

Responsible for the IT operations of a medium-sized mechanical engineering company (approximately 2 000 employees, annual revenue of approximately 400 million euros worldwide). Direct responsibility for 13 employees. At the same time, project manager for an internal carve-out (commercial and technical separation of the two business units worldwide).

Industry: Mechanical and plant engineering

Function: Director IT

• Responsibility for outsourced IT operations; provider management and service management.
• Responsibility for the complete separation of the two business units (applications, SAP R//3, Active Directory, IT infrastructure, ...); project planning and management; selection and management of service providers.
• TiSAX certification for one business unit; budget planning 2025 ff.
• Establishment and structuring of application operations, including the definition of operating models, SLAs/KPIs, and provider management in the SAP environment.
• Preparation of the operating organization for application operations of S/4 Hana (private cloud).

• Advising clients on digital transformation, IT architecture and the introduction of cloud-based environments.
• Gathering, evaluating and prioritizing customer requirements, as well as coordinating projects and programs based on scope, time, quality, budget and risk.
• Designing, documenting, maintaining and developing IT environments, automation and containerized applications.
• Implementing digital platforms, including e-commerce and ordering solutions, event platforms and the product concept for a legal-tech platform.
• Working in interdisciplinary teams and communicating effectively between clients, service providers and technical stakeholders.
• She accompanied companies in their transformation into the digital and agile working world, whether in business process or IT architecture consulting or as part of managed services.
• She developed individual strategies for the digital transformation of our customers and designed new IT environments in the cloud.
• As part of demand management, she gathered, evaluated and prioritized customer requirements.
• She worked in project and program management and coordinated our service providers and those of our customers, monitored their own projects in terms of scope, time, quality and budget and kept an eye on the associated risks.
• She led projects successfully to the end and ensured a professional transfer to regular operation.
• Ms. Sara Mussie has an exceptional understanding of the structure and optimization of IT infrastructures and various cloud technologies as well as modern IT architectures.
• Her areas of responsibility were the development of solutions, considering the service strategy and the possibility of automation, working on design and architecture documentation for projects and services, as well as working on the structure, maintenance and development of IT environments, automation and related tools for our microservice environment and containerized application.
• She was involved in improving our processes and the tool chain used.
• She is confident in handling common IT processes and IT standards.
• Ms. Sara Mussie has very good knowledge of PHP, PHP OOP, Laravel, MySQL, VueIs | Vuex, HTML | CSS | JS, Bootstrap, MongoDB, NodeIs and Python.
• To this day, Ms. Sara Mussie remains available to us for consultation requests from specific clients.