Backup Experts in Munich

• Modernization of a large-scale Java enterprise application*

The project is modernizing a complex enterprise application that has grown over many years. The existing Spring-based legacy system runs on Java 8, OSGi, and Eclipse RCP and is being gradually migrated to a modern, maintainable architecture with Java 25 and Quarkus.

Marcus works on analysis, architecture, refactoring, and implementation. One focus is on untangling historically grown structures and dependencies and on building a clean, sustainable Java and Quarkus technology stack.

Tools & technologies: Java 8, Java 25, Quarkus, Hibernate ORM with Panache, EclipseLink, OSGi, Eclipse RCP, Maven, JUnit, Mockito, REST, JSON, Git, Eclipse IDE, IntelliJ IDEA Ultimate, Jira, Confluence

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation

• Set up Azure Kubernetes clusters (AKS) with network policies, security groups, and RBAC
• Developed Terraform-based infrastructure as code for secure, reproducible deployments in the BMW Azure cloud
• Hardened CI/CD pipelines using Jenkins, SonarQube, Fortify SSC, and Contrast AST
• Integrated SAP BTP/Kyma and ServiceNow GRC

• Installation, maintenance and regular upgrade of the DB systems with 19x
• Use of OPatch and RU 19.27 on RHEL 8x, SLES 15.x and Windows
• DBA for DACH and European customers in production and last test environments (e.g. Konrad Adenauer) as well as others in CDB
• Processes via Confluence
• Support in operations for customers SR via Metalink

• Plan & Prepare (Site Design & Readiness): Inventory & Design: Dell PowerEdge R-Series, Aruba switches (L2/L3), notebooks/peripherals; serials/asset tags, IPv4/IPv6 addressing, VLAN-/DHCP-/DNS plan

• Runbooks/MOPs: site rollout runbook, backout strategy (<15–30 min), risk register, communication matrix; approvals via CAB/change

• Images/Packages: Golden Image (Win10/11), driver packs, BIOS/UEFI baseline; O365/Teams/OneDrive KFM; BitLocker policies; MECM/SCCM, Intune/Autopilot, MDT/WinPE

• Logistics: shipping/customs clearance, RMA/DOA, on-site spares; tools (barcode scanner, label printer), "Go-Bag" (cables, SFPs, console cables)

• Deliver (on-site implementation): End devices: swap & migration (USMT/OneDrive KFM), peripherals (ATB/BT printers, scanners, boarding gate hardware); domain join, compliance checks, O365 activation, printers/queues, network drives

• Acceptance: functional tests for DCS/CUTE/CUPPS/CUSS stations, ticketing/check-in workflows, boarding gates

• Server (R-Series): rack & stack, cabling (PDU redundancy, fiber/copper), labeling/naming; firmware/RAID (PERC), Lifecycle Controller, iDRAC network; Windows Server 2022/2025 + CIS/BSI hardening; agents (backup/AV/EDR/monitoring), time service/NTP auth, Syslog/SNMPv3

• Network (Aruba): VLANs, LACP trunks, MSTP root; PortFast + BPDU Guard at the edge; QoS (EF/AF); dual stack (v4/v6), DHCP relay. NAC/802.1X with ClearPass/Radius/TACACS+, roles + MAB fallback; guest isolation, ACLs (Guest→Mgmt deny). Telemetry: sFlow, SNMPv3, Syslog→SIEM; LLDP→inventory/CMDB

• Airport specifics: CUTE/CUPPS/CUSS terminals; DCS/Amadeus/SITA connectivity; FIDS (read-only); bag tag/boarding pass printing; changes in off-peak/night windows

• Stabilize (hypercare): first-day support, KPI tracking (login times, ticket volume, error classes), QoS fine-tuning

• Troubleshooting: Wireshark/iperf, event logs, switch counters, sFlow flows; fast incident handling as SPOC

• Knowledge transfer: short training sessions for station teams, mini-runbooks (fault/recovery)

• Close (documentation & handover): docs & CMDB: final configs (switch/server), topology/patch plans, IP tables, serial/asset lists, before/after photos

• Acceptance & sign-off: UAT protocols, functional evidence (use cases), return/reuse of old hardware

• Lessons learned: risks, standard packages, driver freeze, "known issues"

• Interfaces/communication: station IT, airport IT, SOC/NOC, ground ops/ramp/check-in, provider (SITA/Amadeus). ITSM: ServiceNow (Inc/Req/Change/KB), handover to BAU

• Cisco SDA LAN network
• Transition and transformation

• Analysis and optimization of the VMware environment for operation in a critical infrastructure environment
• Planning and execution of updates for the VMware and hardware environment in a critical infrastructure environment
• Deployment of Skyline Health Diagnostics
• Review of existing documentation
• Training and onboarding of new internal staff
• Support for migration and upgrade projects
• Preparation for moving scripts in the virtualization environment to GitLab
• Ticket handling with ServiceNow

• Analysis and assessment of government business processes with regard to migration capability
• Definition and preparation of the technical framework conditions in the new master data center
• Development and optimization of migration procedures and processes
• Transformation of existing solutions to new technical standards (technology refresh)
• Coordination of architecture and technical cross-cutting topics

• About 800 different server VMs, operation and lifecycle/asset management of about 40 ESXi hosts (Lenovo)
• Upgrade of all clusters to ESXi/VCSA 7.0U3 and 8. Planning patch management for all hosts
• Cleaning up the AD – many different domains that all needed to be migrated into the main environment. Planning/execution
• Veeam – check the configuration and migrate to a newer, partly virtual infrastructure to make the setup leaner and faster
• VMware – upgrades/updates, general maintenance
• Proxmox POC – evaluate if an alternative to VMware
• Documentation for Veeam/VMware/storage
• Implementation of the uniflow cloud solution
• NetApp migration to new storage, CIFS maintenance and administration of SVMs

• Building the company with a focus on connectivity for IIoT and Industry 4.0, iRPA/process automation, advanced robotics and smart systems, sensors and services
• Project management and software architecture for IoT gateway development (since 2020) with protocol translation, IT/OT convergence and GRC
• Developing RPA bots for automating and monitoring industrial processes with an agent-based AI approach (since 2020)
• Implementing unsupervised clustering and anomaly detection for time series data in big data streaming pipelines (since 2021)
• Introducing a Docker-based release train for OTA updates with DevSecOps and CI/CD (since 2018)

• Provision and operation of Oracle databases within the agreed service levels.
• Storage administration using Oracle ASM feature.
• Oracle Grid Infrastructure and database patching.
• Ensure SLAs and operational KPIs are met, coordinating internal and external support during major incidents.
• Create and exercise reliable backup strategies and periodic restorations.
• Plan and execute migrations from non-multitenant to multitenant architectures and consolidate databases into multiple containers.
• Configure Oracle database authentication with Kerberos.
• Deploy and administer Azure Database for PostgreSQL (Flexible Server) including configuration, scaling, and high availability setup.
• Migrate on-premises PostgreSQL databases to Azure using pg_dump/pg_restore, pg_dumpall, and Azure Database Migration Service.
• Configure backup and point-in-time restore policies for compliance and recovery objectives.
• Implement monitoring and alerting with Azure Monitor, Log Analytics, and custom dashboards.
• Perform query performance tuning by analyzing execution plans, optimizing indexes, and adjusting parameters (work_mem, shared_buffers, autovacuum).
• Collaborate with developers to implement schema design improvements, partitioning, and connection pooling (PgBouncer) for scalability.

• Setup and configuration of an M365 tenant on a hybrid basis
• SSO integration of the existing app infrastructure like Metamost, Huhu, etc.
• License consulting, Entra ID initial configuration, MFA, Conditional Access, Privileged Identity Management
• Intune: initial configuration, Windows 11 Autopilot, iPhone AES
• Takeover of the tenant and preparation of a security audit
• Rollout of iPhones with AES (formerly DEP) as COPE (Corporate Owned, Business Enabled)
• Connecting external customers with enhanced security through Conditional Access
• Consulting on cloud-first strategy and migration to a cloud-only business
• Connecting various apps via SSO/SCIM (e.g. Atlassian, Personio, Adobe)
• On-premises AD: security audit and project management for replacing the local AD (migration of file servers, Navision2016, user clients joined to Entra ID)
• Copilot rollout with connection to external data sources and configuration via Intune
• Support for TISAX and ISO27001 preparation
• Setup and hardening of Entra ID, switching MFA to phishing resistant via Conditional Access
• Intune management for Windows and Apple clients, web enrollment switch to AES, introduction of Autopilot, app management, integration of Microsoft Defender
• Building a device baseline for Windows (COBO) and iOS/Android (BYOD)
• Teams/SharePoint Online: access concepts and integration into Teams
• Maintenance and backup of Entra ID and Intune tenants (drift management)
• M365 backup with Veeam
• Extending Conditional Access policies, introduction of Privileged Identity Management with hardware tokens and an on-premises admin tier concept
• Revision of existing GPOs regarding structure, security, and compliance
• Security audit and hardening of on-premises Active Directory and cloud tenant, SAML VPN, PIM introduction
• Support for the HR department in introducing a booking portal and general system engineering administration & security
• Introduction of Conditional Access and passwordless MFA, platform SSO, Defender for macOS/iOS, macOS compliance with Intune, Code2 signature configuration

• Support for Oracle administration and tuning
• Area: administration, Oracle RAC, Oracle ASM
• Tools: Oracle 11g, Oracle 12c, PL/SQL, SQL, SQL*Plus, Oracle RAC, Oracle ASM, check_mk, Namis, Oracle Cloud Control, Apache Tomcat, Wildfly, Oracle WebLogic Server

• Platform: Python ecosystem, RHEL 8, K10, AWS IoT Core, AWS Lambda, MLOps
• Software: Java JEE/cloud, IntelliJ IDEA, AWS IoT Core, AWS Edge and Lambda, AWS SageMaker SDK, Docker Compose, Kubernetes, OpenShift 4, Tekton, Flux, Helm charts, JSON/XML technology, Nginx, Apache Spark, OpenAI (GPT Plus, DALL-E 3, Whisper), GAN, GitHub Copilot, AI/machine and deep learning, Jupyter notebooks, TensorFlow 2, Colab, Keras API, Prometheus, Grafana, Conda, Python 3.9, PySci stack (NumPy, pandas, Scikit-learn, matplotlib)
• Responsible for webinar:
• IoT edge computing: architecture, components, resources, management
• IoT edge computing with MicroK8s, designing and creating flows/diagrams for AWS, three-step model for IoT ecosystem
• IoT processes, connectivity, data transfer and deployment, security
• Optimization of edge computing for IoT networks and services (AWS SQS queue, SNS notifications, events, analytics, buttons, device management/defender, Things Graph)
• Machine/deep learning frameworks (models, training, pipeline optimization, deployment in the cloud/at the edge (OpenShift), monitoring workloads with Prometheus and Grafana)
• Performance optimization for low latency/resilience using adaptive ML/DL/RL models for customer IoT data
• Analysis of large sensor data sets with Apache Spark, Kafka clusters
• Kasten K10 data management platform on Kubernetes multi-cluster with Helm chart, deployment, backup/disaster recovery (RTO/RPO), data lifecycle and security management
• Implementation of multilayer artificial neural network (ANN) with TensorFlow 2 and Colab for regression and classification; data analysis and provisioning for applications; development of models for testing and training, deployment of models
• Automation of business streamline processes with AI (Azure OpenAI, Discord bots/Zapier apps AI assistants (IntelliJ, GitHub Copilot))