Burp Suite Experts in Germany

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

Enterprise Agile Planning Platform

Key achievements:

• Introduced and promoted shift-left testing practices.
• Established and maintained QA metrics to track release quality and support data-driven decision-making.
• Reviewed Selenium-based automated tests, identifying coverage gaps and prioritizing improvements with the automation team.

Responsibilities:

• Managed QA activities throughout the release lifecycle, coordinating testing efforts and ensuring release readiness.
• Mentored and onboarded 10 QA engineers and fostered knowledge sharing.
• Conducted technical interviews and participated in candidate evaluation.
• Collaborated with stakeholders to improve quality practices.

Conducted an independent technical assessment of an AI-enabled software platform, combining AI risk auditing, cybersecurity analysis and software architecture review. Reviewed application components, APIs, data flows, LLM integrations, retrieval-augmented generation, multi-agent orchestration, authentication, tenant isolation, dependency vulnerabilities, AI governance and model lifecycle controls. Authored a technical audit report with a structured risk register, source-code evidence, regulatory references, corrective actions, AI system inventory, risk classification, remediation roadmap and Key Risk Indicators.

Technologies: TypeScript, JavaScript, React, Next.js, Node.js, REST APIs, MongoDB, Redis, AWS serverless services, OAuth 2.0 / OpenID Connect, LLM APIs, RAG, vector search, multi-agent orchestration, Model Context Protocol, C4 architecture modelling, threat modelling, NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, OWASP guidance, MITRE ATLAS

• Preparation of a complete IT security concept (ISiKo)
• Implementation of BSI / NATO / national security requirements
• Risk analysis, documentation, audit preparation
• Consulting and management of development teams in Cybersecurity Recovery and Resilience
• Genua firewalls, VPN, VS-NfD migration from Checkpoint and PaloAlto firewalls
• Administration of log sources: firewall traffic, ALG (SIP calls), ATP, DLP
• System administration – servers, AD, clients (according to BSI)
• Stakeholder communication (C-level / government agencies)

• Planned and carried out black-box adversarial testing of traffic-sign computer-vision pipelines; created a threat model and attack-surface analysis for safety-critical scenarios
• Built a programmable hardware proof of concept using a holographic POV fan and a repeatable test harness to run real-time experiments and gather evidence for vulnerability assessment
• Measured misclassification across lighting, distance, and angle, achieving up to 90% untargeted misclassification; delivered reproduction steps, PoCs, and prioritized mitigations, and documented limitations and residual risk

• Developed a custom tool using the Mistral 7B LLM to scan, validate, and report security vulnerabilities.
• Security tested AI agents, bots, and other LLMs, focusing on prompt injection, model inversion, data poisoning, EDR/AV bypass and evasion techniques, membership inference, model evasion, overfitting to malicious inputs, and contextual manipulation.
• Onboarded repositories to SAST solutions for security scanning, implemented secrets scanning, DAST, and SCA, and used ZAP for DAST in CI/CD pipelines.
• Delivered security awareness training and developed CTF challenges and training materials to improve developers' security knowledge.
• Planned and carried out bi-annual red teaming operations based on the MITRE ATT&CK framework and led internal and external pentests based on the OWASP Top 10 framework for 70+ applications worldwide, resulting in the detection, reporting, and remediation of hundreds of vulnerabilities.
• Triaged HackerOne reports.

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Completed 25+ hands-on labs focusing on digital forensics, incident response, and advanced threat hunting techniques.
• Earned top-tier badges in malware analysis, enterprise log analysis, and threat intelligence gathering.
• Developed specialised skills in forensic report writing and evidence collection methodologies to support incident investigations.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Successful implementation of vulnerability management with DefectDojo
• Consulting and implementation of technical and process-related aspects of vulnerability management with DefectDojo
• Consulting on the implementation of a secure software development lifecycle
• Skills: Gitlab, DefectDojo, Vulnerability Management, SCA, SAST, DAST, Python, Kubernetes, ArgoCD, Docker, AWS, Azure, Whitesource/Mend, Greenbone

• Creation of test concepts
• Requirements management
• Release planning and support
• DDS management
• Reporting (test report, AFO TestMatrix)
• UAT/BAT coordination
• Onboarding of new team members
• Team planning / capacity planning
• Support with documentation
• Methods/tools/technologies: black box, white box, exploratory testing, E2E testing, regression testing, L&P testing, acceptance testing and interface testing, integration and system testing, networking, JIRA with Zephyrscale plug-in, Confluence, RISE Portal, Ethernet, IPv4, IPv6, Linux, VM, Postman, SQL, SQL-Developer, Bruno, Wireshark, cloud, Burp Suite, Notepad++

• Pioneered first enterprise AI-SAP integration at ALDI SÜD, deploying AI-driven automation within one of retail's largest SAP S/4HANA programs, eliminating 50% of manual pre-cycle validation time and establishing replicable automation framework across 11 countries
• Led end-to-end SAP project lifecycle management for implementations across SAP S/4HANA and Manhattan Systems, supporting 7,300+ ALDI SÜD locations globally across Europe and Australia
• Served as primary executive liaison to C-level stakeholders across 11 countries for strategic SAP transformation programs
• Orchestrated automation, performance, and volume testing for critical releases, maintaining 99.9% system SLA compliance during peak retail periods
• Managed cross-functional international teams of 15+ specialists, delivering projects 20% faster than industry benchmarks
• Standardized SAP processes across 11 countries as part of one of retail's largest SAP implementations
• Directly managed €2M budget with 98% allocation accuracy across 12 concurrent projects
• Reduced SAP S/4HANA migration costs by 18% through strategic vendor contract renegotiations and optimization

• Performed security assessments and penetration testing on Microsoft AI models for text, image, and video generation.
• Conducted prompt injection attacks through diverse input vectors, including crafted text, steganographic images, and manipulated visual elements (e.g., varying opacity and embedded content).