Azure Container Registry Experts in Germany

I designed and developed an AI-powered multi-tenant platform on Azure that transforms SAP process recordings into technical documentation, presentations and automated tests, processing over 15,000 process recordings for enterprise customers like Würth. I owned the architecture, the production releases and the DevOps setup. I also designed a multi-tenant system with SSO and role-based access on Azure. Implemented an MCP Server with Dynamic OAuth Authentication.

Main Tasks:

• Sprint planning and feature preparation
• Design the multi-tenant platform architecture (FastAPI, SQLAlchemy, PostgreSQL row-level security for tenant isolation)
• Develop AI pipelines with Prefect for transcription (Azure Speech API), document generation and SAP screen-recording analysis (Claude, gpt-4-mini)
• Design and implement an MCP server to expose tenant knowledge to LLM clients (Claude), with async retrieval and reranking
• Implement LLM cost tracking, rate limiting and client pooling for Anthropic/OpenAI/Azure OpenAI endpoints
• Set up CI/CD: Docker images to Azure Container Registry, GitHub Actions, Azure Static Web Apps, Alembic migrations in containers
• Manage production releases and execute live data migrations for enterprise customers
• Define engineering standards and architecture patterns for the team

Environment: Azure / Azure Foundry / Python / FastAPI / Prefect / React / PostgreSQL

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Developed backend features for Modern RIS, a web-based Radiology Information System integrated with the existing Classic RIS via WebView.
• Worked on a modular Spring Boot backend covering clinical workflows such as appointments, examinations, patients, orders, reporting, billing, and inventory.
• Contributed to event-driven architecture using domain events to decouple workflows across backend modules.
• Implemented REST/OpenAPI endpoints, service-layer business logic, DTO mapping, validation, and integration points for the React frontend.
• Worked with PostgreSQL-backed domain models, Liquibase database changes, read/write model separation, and legacy RIS database structures.
• Integrated authentication and authorization flows using Keycloak and OAuth2.
• Added and maintained unit/integration tests using JUnit, Rest Assured, Testcontainers, and project-specific test utilities.
• Supported CI/CD and local development workflows using Maven, Docker Compose, Jenkins, and generated OpenAPI clients.

Tech stack: Java 21, Spring Boot 3.5, Maven, PostgreSQL, Liquibase, Keycloak, OAuth2, REST, OpenAPI/Springdoc, MapStruct, Lombok, Docker, Testcontainers, Jenkins.

• Supporting several agile teams in the new product development of an enterprise CRM and ERP application
• Web frontend development with Angular 17–21 (microfrontends, Domain-Driven Design, MDB-Bootstrap)
• Backend development with C# and .NET 7–10, MongoDB, MassTransit, RabbitMQ, Entity Framework Core, ElasticSearch (microservices, DDD)
• Technical feature design for assigned tasks
• Technical architecture design including forward-looking planning of AI-supported extension options
• Proof-of-concept implementation of AI-supported workflows with n8n and a locally hosted LLM (Ollama)
• Coordination with stakeholders and Product Owners, support with sprint planning

Result: Delivery of production-ready microservices and frontend modules in agile sprint cycles.

Environment: .NET 7–10 · Angular 17–21 · C# · TypeScript · OpenAPI · Microfrontends · DDD · Kubernetes · Docker · Helm · MS SQL Server · PostgreSQL · MongoDB · MassTransit · RabbitMQ · EF Core · ElasticSearch · Kibana · Azure DevOps · KeyCloak · n8n · Ollama

• Software development
• Technical design of software architecture and design (considering functional and non-functional requirements)
• Frontend and Backend
• Refactorings
• Code reviews
• Unit tests
• Automated integration tests
• E2E tests

Global Identity Services (GIS) is the identity provider for the Digital Services Platform (DSP). GIS is responsible for authenticating and authorizing end users and other DSP services by issuing security tokens. This includes:

• Identity management (e.g., user registration, password reset and change, user profiles)
• Management of roles and permissions
• Single Sign-On (SSO) across DSP services
• Management of OAuth resources and terms and conditions

• Led engineering strategy development and execution across multiple teams (Engineering, DevOps, SysAdmin, QA), defining quarterly OKRs and roadmaps to align with business objectives.
• Established comprehensive engineering excellence framework including coding standards, career progression paths, and critical operational policies.
• Successfully conducted technical due diligence during investment rounds, presenting technology infrastructure to potential investors.
• Developed and implemented key organizational policies including incident management, deployment guidelines, and security protocols.
• Streamlined recruitment process and managed performance reviews, resulting in improved team composition and capabilities.
• Architected and implemented full-stack solutions using TypeScript, Node.js backend and Next.js frontend with Styled Components.
• Designed and optimized serverless architecture utilizing AWS Lambda, Step Functions, State Machine, ECS, API Gateway, and multiple databases (DynamoDB, MongoDB, Postgres, MariaDB, OpenSearch).
• Implemented GraphQL for frontend requests and REST APIs for backend services, improving system connectivity and data flow.
• Established robust CI/CD pipelines using GitHub Actions and Jenkins, incorporating quality gates and security checks.
• Integrated SonarCloud for static code analysis, enhancing code quality across all repositories.
• Spearheaded infrastructure stability and security improvements while optimizing operational costs.
• Implemented automated testing framework using Jest for backend/frontend and Playwright for E2E testing.
• Created reusable tooling modules for logging, database connectivity, parameter store integration and reusable libraries.
• Designed and implemented microservices architecture using AWS ECS, documented with OpenAPI specifications.
• Enhanced creation and deployment processes through standardized templates and automated pipeline creation.
• Successfully delivered multiple projects on schedule while maintaining high quality standards and best practices.
• Conducted regular 1-on-1s and mentoring sessions, fostering team growth and professional development.
• Participated in cross-functional management meetings, ensuring alignment between technical initiatives and business goals.
• Identified and addressed knowledge gaps through targeted mentoring and training programs.
• Implemented atomic design principles for frontend development, improving component reusability and maintenance.

• Architected and operated cloud-based data and ML platforms for autonomous driving and parking systems, supporting large-scale (multi PB scale) simulation and vehicle data ingestion.
• Implemented security, compliance, and governance standards across Azure subscriptions and cloud resources.
• Managed GitHub organizations and CI/CD pipelines to improve deployment reliability and developer productivity.
• Contributed to hiring and technical interviews as part of the recruitment panel.

Projects:

Project: RWE – Development of a company-wide Zero Trust cybersecurity architecture (CITADEL) Role: Senior Enterprise Cybersecurity Architect / Zero Trust Architect Company: RWE AG Description: Concept and implementation of the strategic CITADEL cybersecurity target architecture at RWE, based on the Zero Trust architecture principle and aligned with regulatory requirements such as NIS2, ISO 27001 and company-wide security governance policies. The goal was to build a measurable, auditable and scalable security architecture with a strong focus on Identity Governance, compliance transparency and operational manageability. Responsibilities & Achievements:

• Zero Trust architecture design: Developed a company-wide Zero Trust reference architecture (Identity, Device, Network, Application, Data) including trust zones, control points and enforcement mechanisms according to NIS2.
• Identity & Access Governance (IGA): Designed and introduced IGA governance structures including role models, recertification processes, segregation of duties (SoD) and lifecycle management for identities and access.
• Security governance & KPIs: Defined and implemented security KPIs and metrics to manage Zero Trust maturity, identity risks and compliance at the management level.
• Compliance & reporting: Built standardized compliance reports and dashboards to support internal audits, external assessments and regulatory evidence (e.g. NIS2).
• Architecture & stakeholder alignment: Worked closely with Enterprise Architecture, IT operations and business units to integrate the CITADEL architecture into existing IT and security landscapes.
• Strategic security consulting: Advised programs and projects on Zero Trust compliance, identity centricity and regulatory requirements in the energy and critical infrastructure (KRITIS) environment. Technologies & Methods: Zero Trust Architecture, NIS2, Identity Governance & Administration (IGA), IAM, RBAC, SoD, Entra ID, SailPoint, Zscaler, Terraform / IaC, Policy as Code, security KPIs, compliance reporting, NIST 2.0, ISO 27001, Enterprise Security Architecture, governance frameworks, risk & control management

Project: Scalable AI Workbench Platform on Microsoft Azure Role: Cloud Architect & Engineer Company: Siemens Energy Description: Design, development and operation of a secure, modular cloud infrastructure to support Data Science, Machine Learning and AI applications for various engineering teams at Siemens Energy. Responsibilities & Achievements:

• Cloud architecture: Designed and implemented an Infrastructure-as-Code solution (Terraform) for automated provisioning of Azure resources (Resource Groups, Storage Accounts, Cosmos DB, Application Insights, networking, PostgreSQL Flexible Server, Azure Container Apps, Azure Container Registry).
• Developer portal: Used Backstage with custom frontend and backend plugins (Node.js, TypeScript, React.js, PostgreSQL, Container Apps) to enable self-service and empower developers, data scientists and AI/ML engineers.
• Role-based access control: Implemented Azure RBAC to grant targeted access (e.g. Storage Blob Data Contributor, Reader) to engineering groups (e.g. AI Engineers) for relevant resources.
• Data platform engineering: Built and configured a multi-layered storage landscape (Raw, Curated, Vector data), including automated container creation and access control for advanced analytics and AI workloads.
• DevOps integration: Integrated with Azure DevOps for CI/CD pipelines to automate deployment, monitoring and compliance.
• Security & compliance: Implemented Private Endpoints, network policies and Managed Identities to ensure data protection and regulatory compliance.
• Collaboration: Worked closely with cross-functional teams to align the cloud infrastructure with business and technical requirements and drive digital transformation at Siemens Energy. Technologies: Azure, Terraform, Azure DevOps, Cosmos DB, Application Insights, Azure Storage, Private Endpoints, Azure Synapse, Azure Machine Learning, Azure Entra ID, RBAC, Backstage, Node.js, React.js, PostgreSQL, Python (automation), Git

• Complete conception, design, implementation, and operations of a voice chatbot
• Evaluation of various implementation concepts (STT, TTS, speech-to-speech)
• Integration into telephone platforms
• Implementation of dashboards and KPIs
• Definition and coordination of customer requirements
• Technologies used: FastAPI, Deepgram, ElevenLabs, LangChain, LangGraph, GitHub Actions, Streamlit, Vonage

• Led a team of 6 software engineers to develop and maintain an AI-driven healthcare platform, enabling automated diagnostics and prescriptions based on real-time ECG data analysis
• Designed and developed a robust Revenue Cycle Management (RCM) system, integrating HL7 and FHIR APIs to enable seamless interoperability, real-time data exchange, and HIPAA-compliant data handling, improving billing efficiency, claim processing, and regulatory adherence in healthcare operations
• Migrated a legacy monolithic application to a scalable microservices architecture, enhancing system modularity, scalability and maintainability while implementing key design patterns such as Strangler, Database-per-Service, API Gateway, Saga and CQRS for efficient service communication and transaction management
• Architected and led a C# 9/.NET 6 microservices ecosystem handling hotel reservations, payments, and loyalty programs, enabling 99.99% uptime across 10+ services
• Defined OpenAPI/Swagger contracts and auto-generated client SDKs, reducing front-to-backend integration time by 50%
• Containerized each service with Docker and orchestrated deployments via Kubernetes, slashing release lead time from days to hours
• Designed PostgreSQL schemas optimized for high-volume transactional workloads and implemented Redis caching layers to accelerate read-heavy endpoints by 80%
• Built Kafka streaming pipelines for real-time availability updates and audit logs, processing 2 million+ events per hour with end-to-end delivery guarantees
• Implemented unit and integration tests for React applications using Jest and React Testing Library, ensuring 80%+ test coverage, improving component reliability, and preventing regressions
• Defined and deployed AWS cloud infrastructure using Terraform, while containerizing and orchestrating microservices with Docker and Kubernetes, improving automation and system scalability
• Built a scalable full-stack booking application using React 18 and Django REST Framework, integrating Celery and Redis for asynchronous task processing, while deploying on GCP with Cloud Run and Firestore, enabling real-time scheduling, payment processing, and automated notifications
• Mentored junior developers through code reviews, pair programming, and knowledge-sharing sessions, improving team efficiency by 30% while maintaining comprehensive API documentation using Swagger/OpenAPI