Burp Suite Experts in Germany

Enrique G.

Data Security

Hamburg

Last position:

Security Architect at Capgemini

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

Halil O.

Principal Cloud & DevSecOps Architect (AWS / Azure / Terraform / Kubernetes / CI-CD)

Bonn

Last position:

Senior Cloud Operations & DevSecOps Engineer (Azure / Terraform / CI-CD) at KfW Bankengruppe

Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).
Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.
Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.
Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.
Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.
Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.
Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.
CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.
Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.
Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.
OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.
Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).
Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.
Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.
Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.
SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.
Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.
Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.
CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.
Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.
Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

Kennedy A.

Cybersecurity Trainee

Essen

Last position:

Cybersecurity Trainee at CYBERDEFENDERS

Completed 25+ hands-on labs focusing on digital forensics, incident response, and advanced threat hunting techniques.
Earned top-tier badges in malware analysis, enterprise log analysis, and threat intelligence gathering.
Developed specialised skills in forensic report writing and evidence collection methodologies to support incident investigations.

Nils K.

Vulnerability management and secure SDLC

Lübeck

Last position:

Vulnerability management and secure SDLC at DB InfraGO AG

Successful implementation of vulnerability management with DefectDojo
Consulting and implementation of technical and process-related aspects of vulnerability management with DefectDojo
Consulting on the implementation of a secure software development lifecycle
Skills: Gitlab, DefectDojo, Vulnerability Management, SCA, SAST, DAST, Python, Kubernetes, ArgoCD, Docker, AWS, Azure, Whitesource/Mend, Greenbone

Eugen B.

Test Manager

Frankfurt am Main

Last position:

Test Manager at Research Industrial Systems Engineering (RISE) Forschungs-, Entwicklungs- und Großprojektberatung GmbH

Creation of test concepts
Requirements management
Release planning and support
DDS management
Reporting (test report, AFO TestMatrix)
UAT/BAT coordination
Onboarding of new team members
Team planning / capacity planning
Support with documentation
Methods/tools/technologies: black box, white box, exploratory testing, E2E testing, regression testing, L&P testing, acceptance testing and interface testing, integration and system testing, networking, JIRA with Zephyrscale plug-in, Confluence, RISE Portal, Ethernet, IPv4, IPv6, Linux, VM, Postman, SQL, SQL-Developer, Bruno, Wireshark, cloud, Burp Suite, Notepad++

Jeet P.

Global SAP Program Manager

Last position:

Global SAP Program Manager at Aldi Sued

Pioneered first enterprise AI-SAP integration at ALDI SÜD, deploying AI-driven automation within one of retail's largest SAP S/4HANA programs, eliminating 50% of manual pre-cycle validation time and establishing replicable automation framework across 11 countries
Led end-to-end SAP project lifecycle management for implementations across SAP S/4HANA and Manhattan Systems, supporting 7,300+ ALDI SÜD locations globally across Europe and Australia
Served as primary executive liaison to C-level stakeholders across 11 countries for strategic SAP transformation programs
Orchestrated automation, performance, and volume testing for critical releases, maintaining 99.9% system SLA compliance during peak retail periods
Managed cross-functional international teams of 15+ specialists, delivering projects 20% faster than industry benchmarks
Standardized SAP processes across 11 countries as part of one of retail's largest SAP implementations
Directly managed €2M budget with 98% allocation accuracy across 12 concurrent projects
Reduced SAP S/4HANA migration costs by 18% through strategic vendor contract renegotiations and optimization

Maryam M.

AI Red Team Engineer

Hamburg

Last position:

AI Red Team Engineer at Applause

Performed security assessments and penetration testing on Microsoft AI models for text, image, and video generation.
Conducted prompt injection attacks through diverse input vectors, including crafted text, steganographic images, and manipulated visual elements (e.g., varying opacity and embedded content).

Bernhard B.

Senior Security Architect

Wiesbaden

Last position:

Senior Security Architect at Intermediate Beratung

Consulting on an ongoing IT security architecture project
Documenting past progress and planning next steps
Applying and implementing the BSI IT baseline protection
Building and maintaining security management systems
Applying the ISO 27001 standard series
Integrating ITIL processes into security architectures
Collaborating with public clients, regulatory authorities and internal and external service providers

Mevlüt Y.

Project

München

Last position:

Project at Physical Adversarial Attacks Using Fan-Based Holographic Projections

Planned and executed black-box adversarial testing of traffic-sign computer-vision pipelines; produced a threat model and attack-surface analysis for safety-critical scenarios
Built a programmable hardware proof of concept using a holographic POV fan and a repeatable test harness to run real-time experiments and collect evidence for vulnerability assessment
Quantified misclassification across lighting, distance, and angle, achieving up to 90% untargeted misclassification; delivered steps to reproduce, PoCs, and prioritized mitigations, and documented limitations and residual risk

Seyed Farhad M.

Senior Product Security Engineer

Last position:

Senior Product Security Engineer at Delivery Hero

Developed a custom tool using the Mistral 7B LLM to scan, validate and report security vulnerabilities.
Security tested AI agents, bots, and other LLMs with a focus on prompt injection, model inversion, data poisoning, EDR/AV bypass and evasion techniques, membership inference, model evasion, overfitting to malicious inputs and contextual manipulation.
Onboarded repositories to SAST solutions for security scanning, implemented secrets scanning, DAST, SCA, and utilized ZAP for DAST in CI/CD pipelines.
Engaged in security awareness trainings, developed CTF challenges and training materials to enhance developer security knowledge.
Planned and executed bi-annual red teaming operations based on the MITRE ATT&CK framework and led internal and external pentests based on the OWASP Top 10 framework for 70+ applications worldwide, resulting in detection, reporting, and remediation of hundreds of vulnerabilities.
Triaged HackerOne reports.

Mohamad A.

Network Security Systems Engineer

Bochum

Last position:

Systems Engineer for Network Security at Bechtle AG

SD-WAN solution by Aruba – Swiss energy company (330 sites): design and implementation of an SD-WAN branch solution with Aruba 9004 gateways, encrypted overlay, policy-based routing, WAN load balancing, and centralized management via Aruba Central.
LAN/WLAN & security – schools in Germany (9 sites): deployment of Aruba switches & AP-505, FortiGate 80F firewalls; setup of Checkmk monitoring, incident and change management, and secure admin access (BeyondTrust).
Multi-site security – energy billing company (20 sites): deployment of a complete Fortinet solution (FortiGate HA cluster, FortiSwitch PoE, FortiAP), IPsec remote-access VPN via FortiClient, centralized management via FortiCloud, IntraID authentication, operations and incident management.
Data center migration – German client: migration of data center switches (Mellanox), firewall cluster, and OfficeConnect switches to a new data center; securing configurations, implementing HA designs, testing, monitoring, and coordinated change and incident processes. Setup of two new 6300 M VSX clustered switches.
Data center security – university hospital: implementation of a high-availability FortiGate 400F firewall cluster across three data centers; security policy design, operational support, and change/incident management.
Enterprise campus & network access control – manufacturing company in Germany: introduction of Aruba ClearPass NAC, setup of a VSX-based switching architecture, secure WLAN access with MPSK, and integration into existing networks.
EU client (Germany & Poland) – Sophos firewalls: operations, incident and change management of Sophos firewalls including IPsec VPN; troubleshooting and ongoing optimization of security configurations.
Network modernization – pharmacy client in Germany: design and rollout of core and access switching (Mellanox, Aruba Instant On), migration from Sophos to Fortinet firewalls, network segmentation, and security hardening.

Evgenii T.

IT-Cybersecurity Engineer

Freising

Last position:

IT-Cybersecurity Engineer at EuroTechStudy

Vishnu K.

Red Team Engineer (Professional Management Level VI)

Last position:

Red Team Engineer (Professional Management Level VI) at Schwarz Group (Lidl, Kaufland, Stackit)

Developed Red Team infrastructure for real-world attack simulations using Sliver C2 and custom tools
Executed advanced Red Team operations, integrating AI/LLM security research for prompt injection attacks
Conducted comprehensive breach assessment attacks and vulnerability assessments across enterprise infrastructure
Performed root cause analysis and purple team exercises, generating executive-level reports
Lead LLM red teaming initiatives to improve AI model security for GPT-4, Mistral, and internal GenAI models

Jörg H.

Managing Director; Data Protection Officer; Information Security Officer

Last position:

Managing Director; Data Protection Officer; Information Security Officer at Datenschutz24 (brand of Sovestro GmbH)

Drafting company agreements related to data protection
Acting as a mediator between business interests and data subject rights in a corporate context
Process analysis and evaluation regarding data protection and information security implications according to GDPR, BDSG, BSI baseline protection
Support for information security audits according to ISO 27001
Implementation of change management processes
Analysis of IT infrastructure and deriving recommendations
Expert support in legal proceedings and communication with supervisory authorities
Preparation of data protection impact assessments (DPIAs) and procedure and processing documentation (VVZ)
Training on corporate data protection and information security
Cooperation with law firms in legal proceedings

Alexander N.