Bicep Experts in Germany

Financial services provider, >10,000 employees

• Entra ID: App Registrations, Hybrid Identities, group and permission concepts, Conditional Access, MFA, RBAC, and PIM.
• Azure IaaS/PaaS, Networking, Security, Governance, Monitoring, and automation with Bicep and PowerShell.
• Consulting and technical support for internal cloud projects.

Multi-Agent Document-Generation Platform

Problem:

Turn a single prompt into a well-researched, structured and cited document, while keeping the user in control: every stage can be reviewed, corrected or revisited before the system moves on.

Architecture:

A multi-agent system orchestrated by a central controller. More than 20 specialised pydantic-ai subagents (understanding, structuring, planning, research, writing, assembly, cross-reference check, glossary, citation, reference table and more) pass results forward through a shared plan persisted in Postgres (asyncpg); a runner layer dispatches each task by name to its agent, and mechanical steps such as formatting, table of contents and list of figures are deterministic code instead of LLM calls. Provider (Anthropic or OpenAI) is a configuration setting, and responses stream over Server-Sent Events.

Hosting & Infrastructure:

Stateless container run as a Scaleway Serverless Container on a private network with managed PostgreSQL, object storage for finished documents and assets, and centralized log shipping (Loki / Scaleway Cockpit), provisioned with OpenTofu modules and deployed through GitLab CI; usage is metered per API key.

My Contribution & Key Decisions:

• Central decision controller: a satisfaction classifier turns the user's free-text feedback into a verdict (keep working, advance, cancel or revise an earlier task), and a middleware applies it to the plan. Plan progression supports jumping back to earlier tasks and re-running the stages after them.
• Research and writing fan-out: planning produces a plan from which a research-design agent generates individual research tasks and a writing-design agent generates individual writing tasks, each linked to the research it needs. Every task runs in its own dedicated agent with its own conversation history.
• Self-review and human-in-the-loop: after each step a critical-thinking agent reviews the output; the user can accept, refine, or ask questions about a critique before the plan advances.
• MCP integrations: two remote MCP servers, web search and internal document search, connected through pydantic-ai with retries and long-running tool-call timeouts. Classifier agents decide per task whether web search is needed, and a small model condenses raw search results into structured findings before they reach the writing agents.

Usage Metering:

Clients authenticate with an API key validated against a key-management service; consumption is charged in credits calculated from token usage per model plus a markup, and exhausted quota is answered with HTTP 429.

• Azure Landing Zone architecture: Design and implement a hub-spoke, multi-region-capable Azure landing zone that provides the secure, scalable and highly available foundation for autonomous driving and parking data/ML platforms.
• Compliance through Azure Policy: Enforce security and compliance standards across Azure subscriptions via Azure Policy (guardrails, deny/audit/deploy-if-not-exists), consistently achieving top-tier infrastructure security scores.
• Infrastructure-as-Code: Automate provisioning and configuration of Azure resources with Terraform and Bicep, with changes delivered through reviewed CI/CD pipelines.
• Azure Databricks and Unity Catalog: Extensive experience operating Azure Databricks with Unity Catalog for centralized data governance, access control, lineage and auditing across workspaces.
• Monitoring and observability: Built and run infrastructure monitoring and logging with Azure Monitor, Prometheus, Grafana and Loki, covering platform health, alerting, troubleshooting and capacity trends.
• Platform at scale: Architected and operate cloud data/ML platforms supporting multi-PB vehicle data ingestion and simulation; orchestrate Argo Workflow-based recompute and autolabeling services scaling to 100k+ concurrent pods on AKS.
• Reproducible ML: Established reproducible training environments with dataset versioning and provenance tracking, enabling auditing and experiment reliability.
• Operational excellence: Automated GitHub organization management and CI/CD pipelines, improving developer productivity and deployment reliability; automated recurring operational processes.
• FinOps: Developed transparent resource utilization and cost-tracking for multi-project Azure environments.
• Leadership: Technical lead for infrastructure topics, collaborating with development, DevOps and security teams; technical interviewer and recruitment panel member for scaling the engineering team.

Through Sourcegarden GmbH, ongoing engagement. Transitioning software development to agentic development in phases, from setup and pilots through transformation and handover.

• Development of a SaaS application for automated claims handling with AI agents (LLM) as the primary development team
• Design & testing of efficient and secure context management setups in the development process (including multi-sub-agent use, memory systems, caching)
• Definition and implementation of LLMOps pipelines with Azure AI Foundry for AI agents in customer contact (including versioning, logging, audit trail, security tests)
• Infrastructure provisioning via IaC (Bicep), application configuration via GitOps-based CI/CD pipelines (rules engine, workflow engine)
• Development of integrated security architecture designs between AI-based & classic applications with a special focus on regulatory requirements
• Integration of workflow and rules engine in a NestJS service architecture — for automated, rule-based control of claims processes
• Probabilistic extraction and preparation of claims data as the basis for rule-based, deterministic decision logic — traceable, auditable, and regulatorily compliant

Conducted an independent technical assessment of an AI-enabled software platform, combining AI risk auditing, cybersecurity analysis and software architecture review. Reviewed application components, APIs, data flows, LLM integrations, retrieval-augmented generation, multi-agent orchestration, authentication, tenant isolation, dependency vulnerabilities, AI governance and model lifecycle controls. Authored a technical audit report with a structured risk register, source-code evidence, regulatory references, corrective actions, AI system inventory, risk classification, remediation roadmap and Key Risk Indicators.

Technologies: TypeScript, JavaScript, React, Next.js, Node.js, REST APIs, MongoDB, Redis, AWS serverless services, OAuth 2.0 / OpenID Connect, LLM APIs, RAG, vector search, multi-agent orchestration, Model Context Protocol, C4 architecture modelling, threat modelling, NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, OWASP guidance, MITRE ATLAS

• Further development and partial new development of a distributed cloud application for providing data in energy trading
• Independent implementation of the infrastructure (IaC)
• Creation of automated CI/CD pipelines, containers, REST APIs, and Lambdas
• Continuous cost and performance optimization
• Collaboration in an international Scrum team and with experts in energy trading
• Technologies: C#/ASP.NET Core; EF Core; PostgreSQL; Terraform/AWS CloudFormation; HTTP; REST/Web API; Swagger/OpenAPI; Azure DevOps; Rider; VS Code; git; Docker; AWS (S3, EC2, Fargate, Lambda, Step Functions, Secrets Manager, VPCs, ALB/NLB, RDS, Cloudwatch, AWS CLI, Amazon MQ); Redis; OAuth; OpenID Connect
• Languages: C#; TypeScript; HCL; Docker; Bash; PowerShell; YML; JSON

• Promotes continuous integration and delivery (CI/CD) by applying DevOps principles to accelerate and automate development and operations processes.
• Provides hands-on support in implementing and deploying IaC using Bicep.
• Manages and optimizes cloud infrastructure on Microsoft Azure, ensuring scalability, availability, and efficiency.
• Implements and monitors comprehensive security measures, especially in network and data security, to protect systems and data.
• Manages and operates Kubernetes clusters to enable efficient orchestration and scaling of containerized applications.

• Responsible for the 5-head development team and Scrum + DevOps approach
• Designed and implemented the cloud architecture for the application landscape
• Lead development for the user management on Azure Cloud using .NET 8/C#
• Development for the user management frontend using React (TypeScript)
• Technologies: Azure AD, Functions, Storage, CosmosDB, Service Bus, AKS, Monitor, Pipelines, Key Vault, MSSQL, Bicep, App Service, Log Analytics, Application Insights, Cost Management
• Backend: .NET/C#; Frontend: Angular (TypeScript)
• Unit testing: NUnit, xUnit, Moq
• CI & CD: Azure DevOps, GitHub Actions, GitLab CI
• DevOps & IaC: Bicep, Terraform, Docker, Kubernetes
• Security & Compliance: ISO 27001, DevSecOps
• Software development approach: Scrum, SAFe, Kanban

• Development of Blazor-Server applications for data management
• Focus on unifying design and user experience
• Mentoring junior developers
• Establishing and consulting for coding guidelines and best practices
• Technologies: .NET 9, Blazor Server, MudBlazor, HTML, CSS, MS SQL Server (T-SQL, Views, Trigger, Stored Procedures, Table-Valued Functions), Entity Framework, Visual Studio, Scrum, agile, git

• Integration of a FortiManager into the existing FortiGate firewall infrastructure to centralize and optimize firewall management.

• Consulting on the migration of email systems to Microsoft 365 Exchange Online
• Conducting end-user training & change management
• Goal: easier communication & collaboration in care operations

• Implementation of specified DevOps solutions to automate infrastructure (Terraform, Bicep, CloudFormation, Ansible) on-premises datacenter (Ovirt, Proxmox, Ceph Cluster, MinIO) and private cloud.
• Administration, configuration and implementation of CI/CD DevOps pipelines (GitLab, GitFlow) to support development process (Artifactory, Prometheus, Istio, service mesh, Helm Chart, OpenShift (Red Hat Enterprise) / Kubernetes cluster), Red Hat Satellite.
• Administration, setup, monitoring and patching of Linux infrastructure based on Red Hat Enterprise for Dev, Test and QA.
• Use of Scrum and Kanban methods.
• Administration, configuration and implementation of security standards for deploying on Dev, Test, QA and Prod stages of the new ePA applications.
• Development of new plugins and add-ons needed on current infrastructure.
• Database support.
• Data analytics support (Python, Spark, Pandas, Power BI, Splunk Enterprise).
• Implementation of best practices for DevSecOps and BizDevOps using GitOps (ArgoCD), Streamlit framework, Semaphore Ansible UI.
• Configuration and testing of iperf, uperf, sysbench using benchmark-operator for external source data and IoT/MDM devices, creating reports via ELK / OpenSearch.
• Building a new Databricks platform to collect and analyze big data from different sources and IoT devices into Hadoop framework (Python, Pandas, PySpark, Power BI, Apache Airflow).
• Building backend data aggregation and processing to automate configuration deployment between different OpenShift clusters and big data framework (Python, Pandas, PySpark, Apache Spark, PostgreSQL, Django 2, Ansible Automation, Jira JSM).
• Building a new ML pipeline platform using Kubeflow, TensorFlow, KServe.
• Data extraction, transformation and loading from different data sources including structured and unstructured data to analytic DWH / big data cluster using Python, Pandas, Polars, Power BI, Django backend and PostgreSQL.
• Setup of new DevOps Test and QA HashiCorp Vault cluster for PKI and IAM.
• Configuration and testing of automated patching based on CVSS score, SIEM-integrated CVEs.
• Use of Nexpose and InsightVM to scan vulnerability events in network, host, container and application.
• Design and implementation of secure and scalable AWS architectures including VPC, EC2, S3, RDS and Route53 and similar setups on Azure and GCP.
• Automated system provisioning and deployment using CloudFormation templates.
• Configuration of IAM roles, policies and permissions to ensure secure access control.
• Patch management, backup automation and disaster recovery setup on AWS infrastructure.
• Monitoring and optimization of system performance using AWS CloudWatch and AWS Trusted Advisor.
• Support of VMware services (vSphere, Aria, Horizon) and the virtual desktop environment.
• Development and maintenance of CI/CD pipelines using Jenkins, GitLab CI/CD and AWS CodePipeline with interface to Nutanix.
• Configuration of AWS CloudWatch to monitor application performance and system events.
• Planning and execution of migration of on-premises applications to AWS cloud platforms.
• Deployment of containerized applications using Docker and Kubernetes in AWS environments.
• Deployment of internal software packages between availability zones using AWS CodeDeploy.
• Building and deploying ML models using Scikit-learn, XGBoost and Spark MLlib including hyperparameter tuning, model evaluation and production deployment.

• Implementation of complex Azure resources using Terraform IaC and Azure DevSecOps pipelines with network security and zero-trust governance policies

• Optimization of the existing network design, firewall and database migration

• Implementation of governance and network policies as Policy as Code (PaC)

• Establishment of company-wide Azure connectivity using Azure VPN as an IPSec tunnel

• Implementation of hybrid on-premises multi-cloud connectivity (GCP, Azure) using Terraform

• Development of Azure Functions for scheduled cron jobs and Service Bus message queuing with topics

• Optimization of messaging with Service Bus premium features and IP whitelisting

• Stakeholder management, customer communication and creation of Architectural Decision Records (ADR)

• Responsible for cost-efficient quick wins in Azure and on-premises systems