AWS CloudFormation Experts in Germany

Built an international e-commerce platform for a multi-vendor marketplace for digital assets from scratch. Designed and operated cloud native architectures at enterprise scale.

• Designed and operated a highly scalable microservice and serverless architecture
• Built the complete cloud infrastructure with Terraform + AWS CDK in AWS
• Provisioned ECS/EKS clusters (Fargate), Application Load Balancers (reverse proxy), and Lambda functions
• Observability & tracing with CloudWatch, DataDog, Prometheus, and Grafana
• End-to-end setup with DataDog (formerly AWS CloudWatch), Prometheus, and custom Grafana dashboards
• Integration of advanced metrics (including ORM mapper) and distributed tracing with Jaeger
• Robust backup and disaster recovery strategies
• RDS Postgres backups and hourly snapshots
• Read-only, asynchronously synchronized replicas with automated master failover in emergencies
• Minute-level rollback capability through versioned Docker images on ECS and Git-based CI/CD pipelines
• Created CI/CD pipelines with GitHub Actions for automated multi-stage deployments (Dev, Testing, Prod)
• Integrated Stripe for international payment processing
• Built a marketplace payment system with multiple parties and payout routines
• Used Algolia for high-performance real-time search of digital assets on the platform
• Federation of services with GraphQL and Hasura
• Later migration to GraphQL Mesh
• Test Driven Development (TDD) - unit, integration, and E2E testing with Jest, Vitest, and Playwright
• Used Next.js / React for modern frontend applications in the nx monorepo
• Enterprise security architecture & access control
• Integration of JWT tokens with Auth0, OAuth, OIDC, IP guards, BOLA protection, and secret vaults
• Authorization concepts with RBAC, ABAC, and native Postgres Row-Level Security (RLS)
• Built internal microfrontends with Retool for fast prototyping and operational business processes

Technologies: ABAC, AWS CDK, AWS CloudWatch, AWS ECS, AWS EKS, AWS Fargate, AWS RDS, AWS S3, Algolia, Auth0, DataDog, Docker, GitHub Actions, Grafana, GraphQL, GraphQL Mesh, Hasura, JWT, Jaeger, Java, JavaScript, Jest, Kotlin, Kubernetes, Monorepo, Next.js, OIDC, Playwright, Postgres, Postgres RLS, Prometheus, RBAC, Redis, Retool, Serverless, Stripe, Terraform, TypeScript, Vitest

IT consulting, analysis, architecture design, new and further development, code review, test automation, continuous integration, continuous delivery in backend and frontend areas for Automotive Project Instavalo.

Frontend:

• Implementation of UI components according to specifications, especially style guides and responsive design eith React and Typescript
• Component testing
• Code documentation
• CI/CD with Gitlab Pipeline

Backend / IoT:

• Analysis and architectural design with AWS Greengrass IoT on Edge Devices
• Setting up Microservices containers with Docker Compose on Edge device with AWS Greengrass and AWS IoT IAM, Token Exchange Service, Ansible
• CI/CD with Gitlab Pipeline, Terraform, AWS ECR
• Logging with Fluentbit Lua Language for AWS Cloudwatch
• Python Lambda for AWS Greengrass Recipe deployment on Edge Devices
• Implementation of test-driven development with JUnit, Mockito, and code Coverage
• Jacoco
• Definition of REST interfaces with OpenAPI / Swagger
• Development and enhancement of software based on Java Quarkus, Typescript NestJs NodeJs and Python
• Authentication and authorization in Aws IAM
• Development of REST and gRPC interfaces for the frontend and backend
• Implementation of Maven dependencies with DevSecOps OWASP
• Spring AI, Jetbrains AI Assistant, Junie, Github Copilot, Claude Code, Agents, Skills, Command, Hooks, Subagents

• Led migration to GCP using Terraform, GKE, and GitOps, improving deployment consistency and scalability
• Implemented Datadog observability stack via Terraform and datadog-operator
• Established automated end-to-end tests and on-call processes, improving incident response and service reliability
• Migrated from NGINX Ingress Controller to Kubernetes Gateway API (NGINX Gateway Fabric)
• Migrated stateful services (PostgreSQL and Redis) to GCP, improving scalability and operational reliability

• Built and further developed an AWS landing zone based on Terraform / OpenTofu (multi-account structure, IAM baselines, network and security standards)
• Designed and operated platform-oriented AWS architectures to standardize infrastructure and operations processes
• Built and operated Kubernetes-based platforms (EKS) as a shared runtime environment for application teams
• Established GitOps-based deployments with Argo CD and FluxCD
• Developed and operated central CI/CD platforms (GitLab CI, GitHub Actions, Jenkins)
• Enabled development and project teams through reusable platform building blocks
• Introduced and implemented FinOps structures (AWS Cost Explorer, CUR + Athena, Infracost, Grafana dashboards)
• Built and operated central observability platforms (Prometheus, Grafana, Loki, Alertmanager, CloudWatch)

• Development and introduction of operations processes
• Preparation of complete documentation packages (including incident management and operations support) to meet compliance requirements
• Introduction of a workshop on IaC (Infrastructure as Code)
• Technical consulting for the project security concept (ISMS)
• Installation and operation of Kubernetes clusters on AWS, on-prem, and Azure
• Hybrid cloud architecture design (on-prem, Hetzner, AWS)
• Analysis and troubleshooting of incidents and system outages
• Network adjustments for firewall rules, gateways, OpenVPN settings, and IPsec tunnels (pfSense)
• Technical consulting on Bitbucket, Jenkins, and GitLab CI/CD pipelines
• Consulting on Ansible deployments and infrastructure automation
• Consulting on building a scalable system in the cloud (AWS / Azure)
• Technologies / Tools: Ansible, Terraform, AWS, Azure, VPN, pfSense, Jenkins, Bitbucket, Kubernetes, GitLab Runner, ISMS, Golang, Prometheus, Grafana, S3, Lambda, RDS, ECS, Cognito, OIDC, Harbor, MinIO, Postgres, Redis, Keycloak, Ceph, Proxmox, CloudFormation, PostgreSQL, Flux CD, Hetzner, IONOS, Sonatype Nexus Repository, Entra ID, Dex IdP, Pulumi

• Creation, maintenance and hardening of Kubernetes clusters employing Ansible and ArgoCD
• Keywords: Ansible, AWX, Kubernetes, NetApp, Prometheus, CI/CD ArgoCD, SSO, Fluent-bit, HAProxy, Calico, Keycloak, oauth2-proxy, SealedSecrets, kubeseal, Aqua kube-bench, CIS-Benchmarks, Aqua Trivy operator

• Design and build of a fully isolated AWS offline environment with no outbound internet access for running a browser-based business application
• Design and implementation of a proxy and response service that terminates all external application calls inside the VPC and serves them from locally stored content; identification of the actual communication needs through measurement-based DNS query logging
• Creation of architecture designs and decision papers including a comparison of options (Application Load Balancer with Lambda and S3, reverse proxy on EC2, private API Gateway) assessed by operational effort, cost, and availability
• Transfer of the solution and operations documentation previously available only for Azure to an AWS target architecture, including reassignment of all services and operational processes
• Automated rollout as Infrastructure as Code (Terraform, CloudFormation) with CI deployment via GitHub Actions, plus setup of private DNS zones and an internal certificate chain for operation without internet access
• Creation of architecture, deployment, and operations documentation and handover to the customer
• Build-up of a private cloud platform on OpenStack at provider TelemaxX with Terraform, including FortiGate HA clusters, FortiManager, and Kubernetes
• Introduction of Policy as Code (Open Policy Agent, Conftest) as well as development of MCP servers (Model Context Protocol) to connect AI assistants to operations and project tools

Successes:

• Made the business application fully operable without internet access for the first time; the cause of the loading error was narrowed down systematically to missing CORS headers after the likely certificate issue was ruled out
• Fully transferred an existing Azure concept to AWS and replaced the manually created environment with a reproducible, CI-based rollout

Technology stack: AWS (VPC, Application Load Balancer, Lambda, S3, Route 53 private hosted zones and Resolver query logging, IAM, CloudWatch, EC2, CloudFormation), Infrastructure as Code (Terraform, CloudFormation, Remote State), CI/CD (GitHub Actions with OIDC, Azure DevOps Pipelines), OpenStack, FortiGate, FortiManager, Kubernetes, Policy as Code (Open Policy Agent, Conftest), offline and air-gap architectures, PKI & certificates (internal CA, TLS, CRL/OCSP), DNS, network segmentation, Linux, Windows Server, Python, Bash, PowerShell, YAML, JSON, architecture design & decision papers, documentation (Confluence, Markdown), Generative & Agentic AI (Model Context Protocol, Agentic AI Coding Tools)

In my role as Senior Cloud DevOps Architect for BP, an oil and gas company, I had the mission to migrate the Electric Vehicle Charging platform of the EV Division from on-premises and Azure to AWS cloud, resulting in a hybrid multi-cloud, multi-tenant SaaS solution.

Deployment with Kubernetes for the application layer meant provisioning Kubernetes clusters managed by EKS and AKS, with a focus on integrating them into a multi-tenant environment. This integration was achieved by using Kubernetes namespaces and access controls to ensure data isolation and privacy enforcement.

In the database layer, we chose an RDS instance with PostgreSQL to support the backend infrastructure of our applications. Tenants shared the same RDS instance, but each had a dedicated schema.

To ingest near real-time data from physical charge points (CPOs), as IoT devices, via the OCPI protocol, we ran into significant delays with batch processing. As a result, we built a real-time streaming data pipeline using Apache Kafka, while prioritizing an event-driven architecture.

Led collaboration across multiple internal teams, external vendors, cloud providers, and on-site partners to integrate over five systems into a unified solution.

Achievements:

• Successfully designed and implemented hybrid multi-cloud solutions, integrating multiple cloud platforms (AWS, Azure) with on-premises infrastructure, using Site-to-Site VPNs, Firewalls, and Load Balancing.
• Led the migration of on-premises infrastructure to multi-cloud, multi-tenant infrastructure, resulting in 30% faster processing times.
• Migrated workloads from VMware and Hyper-V environments to cloud-based VMs, leveraging cloud-native services to optimize performance, cost efficiency, and scalability.
• Designed a multi-tenant Kubernetes platform leveraging the Kubernetes ecosystem, using Karpenter for dynamic EC2 node provisioning, KEDA for event-driven pod autoscaling (e.g., Kafka message lag), and Rancher for centralized monitoring of multiple clusters (EKS, AKS, or on-prem K8s), replacing Microsoft-centric Azure Arc management service.
• Designed and implemented Python-based FastAPI microservices as part of the EV core-backend on AWS EKS application layer, powering data ingestion and customer analytics pipelines.
• Developed asynchronous, event-driven APIs (Python-FastAPI) for real-time integration with CPOs, supporting OCPI 2.3 and OICP protocols.
• Designed and implemented a secure, production-grade Azure Databricks platform using Terraform, ensuring scalability and cost efficiency.
• Migrated on-premises ERP to a hybrid Dynamics 365 architecture with ERP hosted locally and CRM running in Azure, integrated via Azure Arc.
• Automated CI/CD pipelines for Databricks notebooks and jobs using GitHub Actions & Databricks CLI, reducing deployment time. Reduced infrastructure provisioning time by 70% by automating cloud resource deployment with GitOps.
• Ensured compliance with internal audit and data governance standards (GDPR) through OAuth2/OIDC-based authentication and fine-grained role-based access controls.
• Developed a Zero Trust security model, enforcing least-privilege access and microsegmentation, enhancing security posture and compliance with GDPR and NIST.
• Built interactive analytics dashboards in Amazon QuickSight, integrating data from S3 and Redshift to deliver real-time business insights and visualizations with embedded access for multi-tenant users.
• Led cloud security assessments and full-lifecycle cybersecurity integration during M&A, covering AWS, Azure, IAM (Entra ID), and data protection, while aligning security posture with NIST, ISO 27001, and GDPR across hybrid and cloud-native environments.
• Reduced cloud costs by 64% for a client's dev environment by implementing automated start/stop schedules for EC2 and RDS instances via AWS CDK with EventBridge Scheduler or AWS Systems Manager.

Tech stack:

• Infrastructure as Code: Terraform, AWS CDK, Ansible.
• Containers: Kubernetes on EKS, AKS, Docker.
• Streaming Data Processing: Kafka to Confluent Cloud, after AWS MSK.
• Frontend: TypeScript, React, NextJS, Hooks, Styled Components.
• Backend: Python with FastAPI, also Node.js with NestJS.
• Database: Aurora on PostgreSQL with TypeORM, RDS on SQL Server, Azure Databricks full setup and administration, ETL Pipelines.
• CI/CD and GitOps: GitHub Actions, Azure DevOps, ArgoCD.
• Monitoring and Observability: Prometheus and Grafana.
• Virtualization: Hyper-V, VMware Cloud on AWS, Azure Migrate.
• ERP Systems: Odoo, Microsoft Dynamics 365 Business Central on Azure, integrated with Azure Arc.
• Networking: Site-to-Site VPNs, AWS Direct Connect, Azure ExpressRoute, Firewalls (AWS Network Firewall, Azure Firewall).
• Security: IAM, NIST Framework, Zero Trust Security, AWS WAF, AWS Shield, GuardDuty.

• Drive migration of enterprise authorization platform from Styra DAS to open-source OPA via Skipper (Zalando's Golang-based ingress proxy) integration
• Optimise k8s resources and integrate native Prometheus metrics with OPA
• Migrate from internal monitoring solution to Prometheus CRs + Dash0

Tech Stack: Java/Kotlin, Golang, Python, Spring Boot, AWS, Kubernetes, Docker, OpenTofu, Prometheus, Grafana

traigo is VTG's digital rail logistics and fleet management platform. It processes large volumes of telemetry, mileage, geofence, sensor and wagon-movement events in near real time and provides operational services for rail logistics customers across Europe.

As part of Team Customer Selfcare, I worked on the design, implementation, optimisation and operation of large-scale backend services and event-driven processing pipelines — covering both feature development and operational ownership of business-critical production systems. I also regularly acted as first responder for production incidents, data inconsistencies and performance investigations across multiple distributed services.

• Design and implementation of event-driven backend services.
• Migration and replacement of legacy processing pipelines.
• Development of replay / rebuild mechanisms for large event datasets.
• High-throughput asynchronous event processing on SNS / SQS.
• Database and query optimisation for PostgreSQL and DynamoDB.
• Design of scalable read / write models and aggregation pipelines.
• Production troubleshooting and operational support.
• Performance tuning and infrastructure scaling.
• Design and stabilisation of integration and system tests.
• Technical concepts, architecture documentation, and cross-team collaboration.
• Support the further development of existing GitLab CI/CD pipelines

Geofence & Wagon Stay Processing

• Algorithm to detect vehicles within geofences (entry, exit, dwell time).
• Event sourcing with guaranteed chronological order within the affected time window.
• Refactored geofence event and wagon-stay processing logic for performance.
• Resolved race conditions and event-ordering problems in distributed services; server-side filtering, aggregation and optimised query pipelines.
• Repair and replay tooling for corrupted or inconsistent movement data.

Fleet Metadata & Mileage

• Modernised the service; migrated storage from DynamoDB to PostgreSQL to improve traceability and accelerate new features.
• Scalable mileage aggregation and replay mechanisms.
• Read / write models and optimised queries for high-volume mileage calculations.

Sensor & Telematics Integration

• Integrated telemetry and sensor processing pipelines.
• Snapshot and state-calculation logic for sensor systems.
• APIs and persistence models for wagon sensor data; data-quality improvements.
• Further development of a service using gRPC for intra-service communication.

Movement Segment Processing & Routing

• Migrated services to new movement-segment event streams.
• Built replay and rebuild tooling for segment correction.
• Optimised throughput and reliability for high-volume event processing.

Condition Monitoring & Wagon Analytics

• APIs and backend services for wagon condition monitoring.
• Brake-wear prediction processing and wagon analytics functionality.
• PostgreSQL views and optimised query models for operational dashboards.

Operational Reliability - First Responder

• Investigated production incidents and distributed-system failures; DLQ analysis, replay and operational recovery.
• Tuned database performance and AWS infrastructure under production load.
• Improved observability, monitoring and operational tooling.
• Supported rollout strategies, monitoring and post-deployment stabilisation.

• Optimization of software lifecycle processes for SAP platform apps (BTP CAP)
• Development of template MCP servers for S/4 CALM systems of Porsche AI (BTP)
• Design, development, and IT product management for two MS CoPilot custom agents supporting SAP systems (incl. MCP integration)
• Lead Center of Practice: AI-assisted ABAP development
• Initiation and coordination of the proof of concept implementation of conduct.ai
• Advising application teams on software and integration architecture, clean core principles and implementation, as well as AI use on the SAP platform

• Designing new apps as well as enhancing and running 29 Angular apps for digital claims in an Nx monorepo
• Maintaining and improving a shared component library with ~300 libraries for multiple product teams
• Migrating all apps to a new design system including its component library and systematic refactoring
• Developing and maintaining the CI/CD pipelines (Jenkins, Azure DevOps, Terraform, AWS)
• Managing releases independently including branch handling, versioning, PR coordination and production deployment
• Implementing and maintaining tracking (Adobe Analytics)
• Ensuring accessibility according to BFSG/WCAG
• Test-driven development (TDD) with Jest and Cypress
• Code reviews, mentoring and setting up best practices in the team
• Technologies: TypeScript, Angular 16-20, RxJS, NgRx, Nx (Monorepo), npm, HTML, (S)CSS, Storybook, Jest, Cypress, Cucumber, Husky, Node.js, Git, AWS, Azure DevOps (Repos & Pipelines), Jenkins, Terraform, TDD, BFSG, WCAG, Nexus, IntelliJ, Adobe Analytics

• Independently designed, developed, published, and maintained mobile games for iOS and Android.
• Implemented application architecture, gameplay systems, UI, monetization, analytics, and platform integrations.
• Managed the complete release lifecycle, including testing, store publication, production monitoring, and iterative improvements based on analytics.

OpsWorker turns Kubernetes alerts into root-cause analyses, on top of the monitoring a team already runs. I lead the technical side: the agent architecture, the AWS infrastructure it runs on (fully inside EU regions), and the engineering decisions behind it, read-only in the cluster by default, human in the loop for judgment. The stack underneath: Amazon Bedrock and Bedrock AgentCore, agents built with the Strands Agents SDK, the Claude and OpenAI APIs, and the Kubernetes API.