Azure Key Vault Experts in Germany

• Designed and developed a multi-tenant SaaS platform enabling organizations to build their own knowledge bases and chat with brand-customized AI assistants (white-label approach with dynamic branding per organization).
• Implemented a scalable RAG architecture with a GPT-4o tool-use loop, hybrid semantic search, and strict tenant isolation at database and search index level.
• Built persistent, project-like chat sessions including a streaming API (SSE), multilingual support, and speech input/output (STT/TTS).
• Delivered the cloud infrastructure as Infrastructure-as-Code, fully automated per-customer CI/CD pipelines, and an onboarding process for new tenants.

Technologies used: Python, FastAPI, Pydantic (v2 noted), Next.js, React, TypeScript, Tailwind CSS, OpenAI / LLMs (GPT-4o), Azure AI Search, Cosmos DB, Azure Blob Storage, Azure Cognitive Services Speech, Azure App Service, Azure Container Registry, Retrieval-Augmented Generation (RAG), Server-Sent Events (SSE), Docker, Terraform, GitHub Actions, REST, OpenID Connect (OIDC), Multi-Tenancy

• Short description: Lead a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations control while preserving the autonomy of decentralized business units within regulatory boundaries.

• Tasks and activities:

• Overall responsibility for the design, setup, and implementation of an enterprise-wide cloud governance structure (Azure), incl. target picture, roadmap, and operating model.

• Management of internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps) incl. decision-making and escalation management.

• Planning and facilitation of workshops on cloud strategy, governance principles, and the design of areas such as Identity, Connectivity, and Platform Management.

• Definition, implementation, and rollout of cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).

• Building a cloud governance framework aligned with the Azure Cloud Adoption Framework (CAF), incl. landing zone and guardrail concepts.

• Introduction of automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).

• Implementation of cloud security and compliance monitoring mechanisms as well as continuous improvement processes.

• Establishment and operationalization of FinOps in an enterprise environment (central and decentralized FinOps teams), incl. cost management strategies, reporting, and guardrails.

• Integration of governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).

• Implementation of access concepts incl. RBAC design and "break glass" mechanisms (emergency access) as well as certificate automation (ACME / step-ca).

• Achievements:

• Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud usage in a regulated environment.

• Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.

• Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).

• Significantly increased workload compliance for lift-and-shift migrations.

• Technologies used:

• Microsoft Azure Policy, custom policies.

• Terraform, OpenTofu, Terragrunt.

• step-ca (ACME).

• Entra ID.

• Azure Firewall.

• Azure networking, hub-and-spoke architecture.

• Azure vWAN (evaluation).

• Azure Front Door, Azure Application Gateway.

• Azure ExpressRoute.

• Azure Key Vault.

• NetBox.

• GitLab (on-premises).

• Infrastructure, concepts used:

• Cloud shared responsibility model.

• Hub-and-spoke connectivity / central shared services (from a hub-spoke context).

• Central governance with decentralized delivery (business unit autonomy with guardrails).

• Methods used:

• Scrum.

• Stakeholder management (C-level to engineering).

• Cloud governance, Azure Cloud Adoption Framework (CAF).

• DevOps, CI/CD.

• Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.

• RBAC, "break glass" concepts.

• ACME / certificate automation.

• GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.

• Fixing issues in the program logic

• Covering the changes with unit tests

• Analyzing and documenting the data structure of the various applications

• Analyzing and documenting the parameters for configuring the applications

• Analyzing and documenting the measures required to ensure the operation of the applications

• Analyzing and designing the separation of the individual database structures

• Analyzing and estimating the effort for planned extensions

• Analyzing, maintaining and documenting a heterogeneous legacy system landscape for a print media service provider

• Technology: C#, VB.NET, C, Python, Microsoft SQL Server, Visual Studio 2010, JetBrains Rider, Visual Studio Code, arc42, Draw.io, Jira, GitLab

• Supporting several agile teams in the new product development of an enterprise CRM and ERP application
• Web frontend development with Angular 17–21 (microfrontends, Domain-Driven Design, MDB-Bootstrap)
• Backend development with C# and .NET 7–10, MongoDB, MassTransit, RabbitMQ, Entity Framework Core, ElasticSearch (microservices, DDD)
• Technical feature design for assigned tasks
• Technical architecture design including forward-looking planning of AI-supported extension options
• Proof-of-concept implementation of AI-supported workflows with n8n and a locally hosted LLM (Ollama)
• Coordination with stakeholders and Product Owners, support with sprint planning

Result: Delivery of production-ready microservices and frontend modules in agile sprint cycles.

Environment: .NET 7–10 · Angular 17–21 · C# · TypeScript · OpenAPI · Microfrontends · DDD · Kubernetes · Docker · Helm · MS SQL Server · PostgreSQL · MongoDB · MassTransit · RabbitMQ · EF Core · ElasticSearch · Kibana · Azure DevOps · KeyCloak · n8n · Ollama

• Software development
• Technical design of software architecture and design (considering functional and non-functional requirements)
• Frontend and Backend
• Refactorings
• Code reviews
• Unit tests
• Automated integration tests
• E2E tests

Global Identity Services (GIS) is the identity provider for the Digital Services Platform (DSP). GIS is responsible for authenticating and authorizing end users and other DSP services by issuing security tokens. This includes:

• Identity management (e.g., user registration, password reset and change, user profiles)
• Management of roles and permissions
• Single Sign-On (SSO) across DSP services
• Management of OAuth resources and terms and conditions

• New development of project room functions
• Connection of REST API of a self-developed web service (.NET 7/8) as Azure App Service
• UI tests with Playwright
• Extension of Azure DevOps pipelines
• Migration to Azure SQL Server
• Software / technology: SharePoint Online, PowerShell scripts, SharePoint Framework, MobX, C#, Logic Apps, Playwright, Azure SQL Server, Graph API

• Replacement of a Java application and the Oracle DB for loading the internal WerWasWo system using SSIS.
• Development of SSIS packages to load text files into the database (SQL Server)
• Development of a database project for deployment on various servers
• Creation of queries to monitor the loading runs
• Development of a PowerShell script to automate the deployment of the SSDT projects.
• Oracle, SQL Developer, Microsoft SQL Server 2022 on-premises, SQL Server Management Studio v21, Visual Studio 2022, SSIS, SSDT, PowerShell.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• As part of the project, I was responsible for operating a Citrix farm for 600 users, including optimizing the user experience and ensuring high availability.

• I managed and optimized the entire application landscape of a major customer, evaluated and implemented application updates, and ensured the compatibility and security of the software in use.

• I managed user accounts, implemented security policies, and monitored system performance.

• I administered Azure Entra ID to control identities and access rights, implemented security policies, and synchronized on-premises directories with the cloud.

• I implemented and managed Microsoft Intune for central management of client devices, including the configuration and management of BitLocker for disk encryption.

• I managed file servers and NTFS permissions to ensure secure and efficient data access management.

• I handled change requests and last-level support tickets efficiently to solve complex system issues and improve user satisfaction.

• I supported and advised the customer team on various topics and projects, identified areas for improvement, and implemented best practices.

Technologies used:

• Citrix XenApp and XenDesktop
• Microsoft Windows Server 2012R2 and 2022
• Exchange 2016 and Exchange Online
• Entra ID (Azure AD)
• Entra ID Connect
• BitLocker
• PowerShell scripting
• Microsoft Intune
• LDAP (Lightweight Directory Access Protocol)
• DNS services (Domain Name System)
• Active Directory Certificate Services (AD CS)

• New development of the vehicle planning and delivery system (FAPS)

• As part of the modernization of a central backend application, the existing monolithic COBOL-based system was replaced by a service-oriented architecture with Spring Boot. The goal of the project is to make the digital mapping of vehicle planning and delivery future-proof and scalable.

• Work on the technical architecture and interface design

• Development of a service based on Spring Boot for migrating existing data into a new data model

• Development of REST APIs and the related service layer

• Development of middleware for integrating the new backend into an existing client

• Creation of unit and end-to-end tests

• Adaptation of build pipelines

• Developer training for customer staff (Java, Azure DevOps, general support)

• Support for testers and other project members

• Upgrade of the Spring Boot version (& Hibernate)

• Creation of documentation

• Java 8 and 17, Spring Boot, Spring JPA, Hibernate, Optimistic Locking (entity versioning), JUnit, Cucumber, PostgreSQL, Azure Cloud, Microservices, Azure Storage, Azure DevOps, Azure Kubernetes Service, RESTful web services, JSON, Scrum, Confluence, ArchUnit

• Promotes continuous integration and delivery (CI/CD) by applying DevOps principles to accelerate and automate development and operations processes.
• Provides hands-on support in implementing and deploying IaC using Bicep.
• Manages and optimizes cloud infrastructure on Microsoft Azure, ensuring scalability, availability, and efficiency.
• Implements and monitors comprehensive security measures, especially in network and data security, to protect systems and data.
• Manages and operates Kubernetes clusters to enable efficient orchestration and scaling of containerized applications.

• Database design with Oracle DB, JPA and Flyway considering high performance requirements
• Analysis of multiple architecture drafts and identification of technical risks
• Design and implementation of various interfaces and integrations, especially REST APIs and Kafka topics
• Setup of Elasticsearch for monitoring and analyzing log data
• Establishment of an iterative work approach in the project team facing complex business requirements

• Network elements, network, operational and operator-related systems
• Supporting around 20 different products (managed agile)
• Requirements analysis and management (functional and non-functional)
• Test concept and planning (scope, test phases, effort, schedule, resources, organization, etc.)
• Aligning approach with clients and service providers
• Managing and assisting in creation of test cases for system, integration and end-to-end tests
• Guiding and supporting test execution
• Defect management and planning bug fixes with external providers
• Preparing and facilitating workshops
• Regular reporting and creating automated test reports
• Further development of agile testing methodology and configuration of supporting tools
• Conceptual support in developing a quality seal for rating product and service quality of internal and external providers
• Requirements engineering based on ISO/IEC 25010, Scrum, SaFE
• BMC Remedy, Atlassian Confluence, Atlassian Jira (including plugins Xray, Structure), Microsoft Office (incl. Visio), Obsidian, doxis document management system, Gitlab, Obsidian

• Designed and implemented an advanced, agentic RAG pipeline using LangChain and LangGraph for structured data extraction from PDFs, utilizing tools, state management, and OpenAI LLMs (GPT-4) to improve accuracy and handle complex document structures.
• Developed a Google AI agent for extraction of structured information from PDF documents and deployed the agent on Vertex AI.
• Architected data pipelines using Azure Data Factory and Databricks to ingest data from Azure Blob Storage, process it with PySpark, and load it into Azure SQL Database via Linked Services.
• Containerized AI agents and services using Docker for consistent local development and deployment.
• Utilized PySpark and Dask for database querying in coordination with Azure Blob Storage and Document Storage.
• Created a ReAct agent that extracts structured data from PDF documents using tools and integrating Azure Document Intelligence.
• Contributed to the CPO invoices validation check project using Databricks to find existing CDRs and calculate total valid costs.
• Developed a conversational AI agent (chatbot) with a FastAPI backend, integrating RAG for precise tariff extraction and deployed the service using Azure Container Apps.
• Tools used: Azure, Azure OpenAI, Azure Document Intelligence, Azure Blob Storage, Google ADK, Google Cloud, Vertex AI, Gemini, Databricks, LangChain, LlamaIndex Ollama, Docker, PySpark, Azure SQL, Azure Data Factory, Azure AI Agent, Microsoft SQL Server