AWS KMS Experts in Germany

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Designed and implemented Azure Kubernetes Clusters, and managed DNS and Firewall solutions, enhancing network security and reliability.
• Led projects using Agile Scrum methodologies to streamline development cycles and improve project efficiency.
• Fostered and maintained relationships with suppliers to ensure timely project deliverables and resource availability.
• Managed continuous integration and delivery (CI/CD) pipelines using Jenkins, Sonar, GitHub, Bitbucket, and Terraform within the BMW Azure Cloud environment.
• Utilized Fortify SSC and Contrast AST for robust application security testing.
• Directed DevOps engineering initiatives on the SAP Business Technology Platform (BTP), focusing on streamlining development and deployment processes.
• Service Now governance, risk und compliance (GRC&IRM).

• Project support for VMware/Active Directory
• Operational support for administration, process execution
• Creation and review of documentation
• Active Directory, Powershell, VMware VSphere 7, Confluence, Jira
• Windows Server 2016/2019/2022/2025 GUI/Core
• Concept and rollout of Windows Update Services (approx. 500 client/server systems) and takeover of a central WSUS gateway company-wide
• Takeover and redesign KMS/RDS systems company-wide

• installation and maintenance of communication systems on marine vessels
• advanced security checks
• building cluster environments using VMware ESX servers, DataCore, and Dell hardware

• Built and operated an AWS Landing Zone with Terraform / OpenTofu (multi-account structure, IAM baselines, network and security standards)
• Designed and operated platform-oriented AWS architectures to standardize infrastructure and operations processes
• Built and operated Kubernetes-based platforms (EKS) as a shared runtime environment for application teams
• Established GitOps-based deployments with Argo CD and FluxCD
• Developed and operated central CI/CD platforms (GitLab CI, GitHub Actions, Jenkins)
• Enabled developer and project teams with reusable platform components
• Introduced and implemented FinOps structures (AWS Cost Explorer, CUR + Athena, Infracost, Grafana dashboards)
• Built and operated central observability platforms (Prometheus, Grafana, Loki, Alertmanager, CloudWatch)

• Setup and operation of a multi-cluster AWS EKS platform for banking workloads with a unified network and security architecture across 45 AWS accounts.
• Developed and standardized a unified AWS network and security architecture for 45 AWS accounts, enabling consistent governance, connectivity, and compliance for enterprise customer environments.
• Developed and operated a multi-cluster AWS EKS platform to support production workloads, significantly improving scalability, availability, and operational reliability.
• Implemented a GitOps deployment model using ArgoCD and Helm, enabling fully automated, auditable deployments and reducing manual release errors.
• Automated infrastructure provisioning using Terraform and Terragrunt at scale, reducing environment setup time by up to 70% and eliminating configuration drift.
• Established enterprise-grade backup and disaster recovery strategies using Velero and AWS Backup, ensuring reliable multi-cluster recovery and business continuity.
• Introduced Rancher as a self-service Kubernetes platform, accelerating developer onboarding while maintaining centralized security and governance.
• Designed and implemented detailed AWS IAM concepts (roles, policies, trust relationships) to enforce the principle of least privilege for access to accounts, workloads, and CI/CD pipelines.
• Developed AWS Lambda-based pre-provisioning workflows for databases, automating initialization, configuration, and access setup to support secure and consistent application integration.
• Delivered consistent, high-quality results as part of a 5-person AWS Solutions Architecture team, resulting in three consecutive contract renewals.

• Consulting on an ongoing IT security architecture project
• Documenting past progress and planning next steps
• Applying and implementing the BSI IT baseline protection
• Building and maintaining security management systems
• Applying the ISO 27001 standard series
• Integrating ITIL processes into security architectures
• Collaborating with public clients, regulatory authorities and internal and external service providers

• Analysis and optimization of the VMware environment for operation in a critical infrastructure environment
• Planning and execution of updates for the VMware and hardware environment in a critical infrastructure environment
• Deployment of Skyline Health Diagnostics
• Review of existing documentation
• Training and onboarding of new internal staff
• Support for migration and upgrade projects
• Preparation for moving scripts in the virtualization environment to GitLab
• Ticket handling with ServiceNow

• Baseline compliance verification against MAS audit findings
• Building technical architecture concept for 30 technologies to build hardening standard artifacts
• Identifying and building automation possibilities for given technologies based on CIS
• Building the standard baseline configuration based on internal security standard
• Responsible for building Cloud Native Application Protection Platform (CNAPP) architecture artifacts based on Azure cloud platform
• Responsible for RFQ and RFP for different CNAPP solutions (Qualys Total Cloud, CrowdStrike, Azure Security Center)
• Supporting compliance verification and validation via automated scripts for a sample population of IT devices and instances
• Responsible for complete vulnerability management lifecycle using Nexpose, remediation, reporting and integration of results with Splunk, HPSM and Tableau
• Audit support for MAS

• Migrated the Electric Vehicle Charging SaaS App of the EV Division from on-premises and Azure to AWS Cloud, resulting in a hybrid multi-cloud multi-tenant solution
• Developed a streaming data pipeline using AWS MSK for Apache Kafka and implemented an event-driven architecture to ingest and process near real-time data from OCPI-protocol IoT devices
• Implemented multi-tenant strategies including database schema isolation, bridge model for resource sharing, and tenant-based RBAC controls
• Provisioned Kubernetes clusters on AWS EKS with namespaces and RBAC for tenant isolation
• Led migration from on-premises and Azure to AWS using AWS DataSync, Snowball, and Database Migration Service
• Orchestrated collaboration across 5+ systems, vendors, service providers, and on-site teams
• Supported development and maintenance of IT strategy aligned with business requirements
• Managed €40 million infrastructure budget with AWS & Azure cost optimization, achieving 15% savings
• Led 50+ developers to implement advanced database procedures, increasing productivity by 20%
• Spearheaded multi-cloud, multi-tenant infrastructure migration for 30% faster processing times
• Negotiated vendor pricing to reduce payroll/benefits administration costs by 20%
• Developed a two-year infrastructure technology roadmap yielding 25% cost savings
• Tech stack: Kubernetes on AWS EKS, Docker, Kafka/AWS MSK, Terraform, AWS CDK, TypeScript, React, NextJS, Node.js, NestJS, Python, Aurora Serverless, RDS (MySQL, SQL Server), GitHub Actions, Azure DevOps, ArgoCD, AWS Lambda, API Gateway, AWS Security Hub, AWS Database Migration Service, AWS DataSync, AWS Organizations, AWS Control Tower, Odoo, Microsoft Navision, MS Dynamics

• Extended a global large-scale project to improve the multi-tenant GCP data platform using FAST framework concepts, leveraging Terraform, Terraform Enterprise, and GitLab.
• Collaborated closely with security and governance teams to architect and implement secure and compliant GCP environments, focusing on VPC Service Controls, KMS, organizational structure, and guardrails to support the isolation of corporate entities.
• Enhanced the security posture of the enterprise GCP platform by implementing robust security measures, including GCP organization policies, deny policies, and VPC Service Controls to safeguard against potential exfiltration risks.
• Implemented controls based on CSA Cloud Controls Matrix (CCM v4) to secure the GCP cloud environment.
• Automated key components of the GitLab CI/CD pipeline by integrating OpenID Connect (OIDC) for workload identity federation, necessary for a large migration from GitHub.
• Implemented a YAML-based project factory to facilitate easy, secure, and governed provisioning of tenant projects, increasing speed, scalability, and usability while minimizing operational burden.
• Developed a dynamic approach for policy attachment to tenants using a YAML-based custom IAM template approach.
• Evaluated and implemented Google PAM (Privileged Access Manager) in a proof of concept for organization-wide just-in-time access.
• Set up CyberArk SCA and CEM tooling to ensure secure cloud access and provide visibility into the cloud environment.
• Handled GCP incidents, ensuring prompt resolution and operational stability.
• Authored and maintained extensive documentation within an Agile environment, utilizing Jira and Confluence for project tracking and knowledge management.
• Utilized HashiCorp Sentinel as a policy-as-code tool to shift-left cloud security by enforcing policies before infrastructure provisioning.
• Used Prisma Cloud to continuously monitor and secure GCP resources, ensuring compliance and risk mitigation across the organization.
• Developed a custom Org Policy Factory to standardize and automate custom governance across projects, ensuring enforcement of non-trivial organizational controls.
• Architected and built a cloud-agnostic credential lifecycle management platform with Python and GitLab to automate the secure handling of static credentials, improving governance, compliance, and audit readiness.
• Delivered an executive-level presentation on VPC Service Controls to C-level stakeholders, driving strategic awareness and alignment on cloud security posture.
• Led resolution of P1 incidents with high production impact, restoring services under critical time constraints.
• Architected and deployed a central monitoring and alerting solution using Cloud Monitoring and PromQL, providing real-time visibility into system health and proactive incident detection.
• Designed and developed a Python-based broker for self-service integration with an internal developer platform, streamlining onboarding and reducing manual effort.
• Implemented a templating approach for VPC Service Controls, enabling repeatable, secure, and consistent deployment patterns across tenants and environments.

• Fixing issues in the application logic

• Covering the changes with component tests

• Analyzing and documenting the data structure of the different applications

• Analyzing and documenting the parameters for configuring the applications

• Analyzing and documenting the necessary measures to ensure the operation of the applications

• Analyzing and designing the separation of the individual database structures

• Analyzing and estimating the effort for planned enhancements

• Analysis, maintenance and documentation of a heterogeneous legacy system landscape for a print media service provider

• Technology: C#, VB.NET, C, Python, Microsoft SQL Server, Visual Studio 2010, JetBrains Rider, Visual Studio Code, arc42, Draw.io, Jira, GitLab

• Conceptualizing & developing a need-to-know, domain-based identity and access management system in a high-security environment
• Backend development (Python): API & microservice development

• Architected and implemented an enterprise-grade AI Agent Platform leveraging Retrieval Augmented Generation (RAG) architecture to enhance clinical data insights.
• Established robust CI/CD pipelines for LLM applications using CDK and Jenkins, significantly reducing deployment times.
• Implemented comprehensive observability solutions that increased agent reliability across pharmaceutical environments.
• Designed scalable AI workflows with advanced orchestration that optimized context handling for enterprise data sources.
• Technologies: AI Agents (LangChain, LangGraph, Bedrock, Smolagents, Streamlit); LLM Operations (Tracing, Testing, Evaluation, LangSmith, LangFuse); Infrastructure-As-Code (AWS CDK, Terraform, Typescript, Jenkins); Vectors, Embeddings, RAG (OpenSearch, pgvector, PDF Extraction)