AWS KMS Experts in Germany

• Design and build of a fully isolated AWS offline environment with no outbound internet access for running a browser-based business application
• Design and implementation of a proxy and response service that terminates all external application calls inside the VPC and serves them from locally stored content; identification of the actual communication needs through measurement-based DNS query logging
• Creation of architecture designs and decision papers including a comparison of options (Application Load Balancer with Lambda and S3, reverse proxy on EC2, private API Gateway) assessed by operational effort, cost, and availability
• Transfer of the solution and operations documentation previously available only for Azure to an AWS target architecture, including reassignment of all services and operational processes
• Automated rollout as Infrastructure as Code (Terraform, CloudFormation) with CI deployment via GitHub Actions, plus setup of private DNS zones and an internal certificate chain for operation without internet access
• Creation of architecture, deployment, and operations documentation and handover to the customer
• Build-up of a private cloud platform on OpenStack at provider TelemaxX with Terraform, including FortiGate HA clusters, FortiManager, and Kubernetes
• Introduction of Policy as Code (Open Policy Agent, Conftest) as well as development of MCP servers (Model Context Protocol) to connect AI assistants to operations and project tools

Successes:

• Made the business application fully operable without internet access for the first time; the cause of the loading error was narrowed down systematically to missing CORS headers after the likely certificate issue was ruled out
• Fully transferred an existing Azure concept to AWS and replaced the manually created environment with a reproducible, CI-based rollout

Technology stack: AWS (VPC, Application Load Balancer, Lambda, S3, Route 53 private hosted zones and Resolver query logging, IAM, CloudWatch, EC2, CloudFormation), Infrastructure as Code (Terraform, CloudFormation, Remote State), CI/CD (GitHub Actions with OIDC, Azure DevOps Pipelines), OpenStack, FortiGate, FortiManager, Kubernetes, Policy as Code (Open Policy Agent, Conftest), offline and air-gap architectures, PKI & certificates (internal CA, TLS, CRL/OCSP), DNS, network segmentation, Linux, Windows Server, Python, Bash, PowerShell, YAML, JSON, architecture design & decision papers, documentation (Confluence, Markdown), Generative & Agentic AI (Model Context Protocol, Agentic AI Coding Tools)

In my role as Senior Cloud DevOps Architect for BP, an oil and gas company, I had the mission to migrate the Electric Vehicle Charging platform of the EV Division from on-premises and Azure to AWS cloud, resulting in a hybrid multi-cloud, multi-tenant SaaS solution.

Deployment with Kubernetes for the application layer meant provisioning Kubernetes clusters managed by EKS and AKS, with a focus on integrating them into a multi-tenant environment. This integration was achieved by using Kubernetes namespaces and access controls to ensure data isolation and privacy enforcement.

In the database layer, we chose an RDS instance with PostgreSQL to support the backend infrastructure of our applications. Tenants shared the same RDS instance, but each had a dedicated schema.

To ingest near real-time data from physical charge points (CPOs), as IoT devices, via the OCPI protocol, we ran into significant delays with batch processing. As a result, we built a real-time streaming data pipeline using Apache Kafka, while prioritizing an event-driven architecture.

Led collaboration across multiple internal teams, external vendors, cloud providers, and on-site partners to integrate over five systems into a unified solution.

Achievements:

• Successfully designed and implemented hybrid multi-cloud solutions, integrating multiple cloud platforms (AWS, Azure) with on-premises infrastructure, using Site-to-Site VPNs, Firewalls, and Load Balancing.
• Led the migration of on-premises infrastructure to multi-cloud, multi-tenant infrastructure, resulting in 30% faster processing times.
• Migrated workloads from VMware and Hyper-V environments to cloud-based VMs, leveraging cloud-native services to optimize performance, cost efficiency, and scalability.
• Designed a multi-tenant Kubernetes platform leveraging the Kubernetes ecosystem, using Karpenter for dynamic EC2 node provisioning, KEDA for event-driven pod autoscaling (e.g., Kafka message lag), and Rancher for centralized monitoring of multiple clusters (EKS, AKS, or on-prem K8s), replacing Microsoft-centric Azure Arc management service.
• Designed and implemented Python-based FastAPI microservices as part of the EV core-backend on AWS EKS application layer, powering data ingestion and customer analytics pipelines.
• Developed asynchronous, event-driven APIs (Python-FastAPI) for real-time integration with CPOs, supporting OCPI 2.3 and OICP protocols.
• Designed and implemented a secure, production-grade Azure Databricks platform using Terraform, ensuring scalability and cost efficiency.
• Migrated on-premises ERP to a hybrid Dynamics 365 architecture with ERP hosted locally and CRM running in Azure, integrated via Azure Arc.
• Automated CI/CD pipelines for Databricks notebooks and jobs using GitHub Actions & Databricks CLI, reducing deployment time. Reduced infrastructure provisioning time by 70% by automating cloud resource deployment with GitOps.
• Ensured compliance with internal audit and data governance standards (GDPR) through OAuth2/OIDC-based authentication and fine-grained role-based access controls.
• Developed a Zero Trust security model, enforcing least-privilege access and microsegmentation, enhancing security posture and compliance with GDPR and NIST.
• Built interactive analytics dashboards in Amazon QuickSight, integrating data from S3 and Redshift to deliver real-time business insights and visualizations with embedded access for multi-tenant users.
• Led cloud security assessments and full-lifecycle cybersecurity integration during M&A, covering AWS, Azure, IAM (Entra ID), and data protection, while aligning security posture with NIST, ISO 27001, and GDPR across hybrid and cloud-native environments.
• Reduced cloud costs by 64% for a client's dev environment by implementing automated start/stop schedules for EC2 and RDS instances via AWS CDK with EventBridge Scheduler or AWS Systems Manager.

Tech stack:

• Infrastructure as Code: Terraform, AWS CDK, Ansible.
• Containers: Kubernetes on EKS, AKS, Docker.
• Streaming Data Processing: Kafka to Confluent Cloud, after AWS MSK.
• Frontend: TypeScript, React, NextJS, Hooks, Styled Components.
• Backend: Python with FastAPI, also Node.js with NestJS.
• Database: Aurora on PostgreSQL with TypeORM, RDS on SQL Server, Azure Databricks full setup and administration, ETL Pipelines.
• CI/CD and GitOps: GitHub Actions, Azure DevOps, ArgoCD.
• Monitoring and Observability: Prometheus and Grafana.
• Virtualization: Hyper-V, VMware Cloud on AWS, Azure Migrate.
• ERP Systems: Odoo, Microsoft Dynamics 365 Business Central on Azure, integrated with Azure Arc.
• Networking: Site-to-Site VPNs, AWS Direct Connect, Azure ExpressRoute, Firewalls (AWS Network Firewall, Azure Firewall).
• Security: IAM, NIST Framework, Zero Trust Security, AWS WAF, AWS Shield, GuardDuty.

• Operations and extensions of Azure DevOps pipelines

• Operations and extensions of AWS services

• Citrix (Windows 10, Bitwarden)

• AWS: ECR, EKS, CloudFront CDN, Route 53, VPC peering and CNI upgrade, Atlas MongoDB, S3 buckets, static website hosting

• Azure: build and deploy with DevOps pipelines

• Fixing issues in the program logic

• Covering the changes with unit tests

• Analyzing and documenting the data structure of the various applications

• Analyzing and documenting the parameters for configuring the applications

• Analyzing and documenting the measures required to ensure the operation of the applications

• Analyzing and designing the separation of the individual database structures

• Analyzing and estimating the effort for planned extensions

• Analyzing, maintaining and documenting a heterogeneous legacy system landscape for a print media service provider

• Technology: C#, VB.NET, C, Python, Microsoft SQL Server, Visual Studio 2010, JetBrains Rider, Visual Studio Code, arc42, Draw.io, Jira, GitLab

• Preparation of a complete IT security concept (ISiKo)
• Implementation of BSI / NATO / national security requirements
• Risk analysis, documentation, audit preparation
• Consulting and management of development teams in Cybersecurity Recovery and Resilience
• Genua firewalls, VPN, VS-NfD migration from Checkpoint and PaloAlto firewalls
• Administration of log sources: firewall traffic, ALG (SIP calls), ATP, DLP
• System administration – servers, AD, clients (according to BSI)
• Stakeholder communication (C-level / government agencies)

• Designed and implemented Azure Kubernetes Clusters, and managed DNS and Firewall solutions, enhancing network security and reliability.
• Led projects using Agile Scrum methodologies to streamline development cycles and improve project efficiency.
• Fostered and maintained relationships with suppliers to ensure timely project deliverables and resource availability.
• Managed continuous integration and delivery (CI/CD) pipelines using Jenkins, Sonar, GitHub, Bitbucket, and Terraform within the BMW Azure Cloud environment.
• Utilized Fortify SSC and Contrast AST for robust application security testing.
• Directed DevOps engineering initiatives on the SAP Business Technology Platform (BTP), focusing on streamlining development and deployment processes.
• Service Now governance, risk und compliance (GRC&IRM).

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Setup and operation of a multi-cluster AWS EKS platform for banking workloads with a unified network and security architecture across 45 AWS accounts.
• Developed and standardized a unified AWS network and security architecture for 45 AWS accounts, enabling consistent governance, connectivity, and compliance for enterprise customer environments.
• Developed and operated a multi-cluster AWS EKS platform to support production workloads, significantly improving scalability, availability, and operational reliability.
• Implemented a GitOps deployment model using ArgoCD and Helm, enabling fully automated, auditable deployments and reducing manual release errors.
• Automated infrastructure provisioning using Terraform and Terragrunt at scale, reducing environment setup time by up to 70% and eliminating configuration drift.
• Established enterprise-grade backup and disaster recovery strategies using Velero and AWS Backup, ensuring reliable multi-cluster recovery and business continuity.
• Introduced Rancher as a self-service Kubernetes platform, accelerating developer onboarding while maintaining centralized security and governance.
• Designed and implemented detailed AWS IAM concepts (roles, policies, trust relationships) to enforce the principle of least privilege for access to accounts, workloads, and CI/CD pipelines.
• Developed AWS Lambda-based pre-provisioning workflows for databases, automating initialization, configuration, and access setup to support secure and consistent application integration.
• Delivered consistent, high-quality results as part of a 5-person AWS Solutions Architecture team, resulting in three consecutive contract renewals.

• Extended a global large-scale project to improve the multi-tenant GCP data platform using FAST framework concepts, leveraging Terraform, Terraform Enterprise, and GitLab.
• Collaborated closely with security and governance teams to architect and implement secure and compliant GCP environments, focusing on VPC Service Controls, KMS, organizational structure, and guardrails to support the isolation of corporate entities.
• Enhanced the security posture of the enterprise GCP platform by implementing robust security measures, including GCP organization policies, deny policies, and VPC Service Controls to safeguard against potential exfiltration risks.
• Implemented controls based on CSA Cloud Controls Matrix (CCM v4) to secure the GCP cloud environment.
• Automated key components of the GitLab CI/CD pipeline by integrating OpenID Connect (OIDC) for workload identity federation, necessary for a large migration from GitHub.
• Implemented a YAML-based project factory to facilitate easy, secure, and governed provisioning of tenant projects, increasing speed, scalability, and usability while minimizing operational burden.
• Developed a dynamic approach for policy attachment to tenants using a YAML-based custom IAM template approach.
• Evaluated and implemented Google PAM (Privileged Access Manager) in a proof of concept for organization-wide just-in-time access.
• Set up CyberArk SCA and CEM tooling to ensure secure cloud access and provide visibility into the cloud environment.
• Handled GCP incidents, ensuring prompt resolution and operational stability.
• Authored and maintained extensive documentation within an Agile environment, utilizing Jira and Confluence for project tracking and knowledge management.
• Utilized HashiCorp Sentinel as a policy-as-code tool to shift-left cloud security by enforcing policies before infrastructure provisioning.
• Used Prisma Cloud to continuously monitor and secure GCP resources, ensuring compliance and risk mitigation across the organization.
• Developed a custom Org Policy Factory to standardize and automate custom governance across projects, ensuring enforcement of non-trivial organizational controls.
• Architected and built a cloud-agnostic credential lifecycle management platform with Python and GitLab to automate the secure handling of static credentials, improving governance, compliance, and audit readiness.
• Delivered an executive-level presentation on VPC Service Controls to C-level stakeholders, driving strategic awareness and alignment on cloud security posture.
• Led resolution of P1 incidents with high production impact, restoring services under critical time constraints.
• Architected and deployed a central monitoring and alerting solution using Cloud Monitoring and PromQL, providing real-time visibility into system health and proactive incident detection.
• Designed and developed a Python-based broker for self-service integration with an internal developer platform, streamlining onboarding and reducing manual effort.
• Implemented a templating approach for VPC Service Controls, enabling repeatable, secure, and consistent deployment patterns across tenants and environments.

• Conceptualizing & developing a need-to-know, domain-based identity and access management system in a high-security environment
• Backend development (Python): API & microservice development

• Projects in Azure and Google Cloud
• Azure DevOps
• Google GKE and Azure AKS
• Workload Identity Federation
• Creation of all resources with Terraform and Ansible
• Available for projects in DevOps, Kubernetes, Rancher and OpenShift
• High-availability database solutions with Microsoft SQL Server