Change Data Capture Experts in Germany

• Architected the Yatta Integration Layer – a config-driven integration platform on Java 25, Spring Boot 4 (WebFlux), Temporal, gRPC and Kafka, enabling new third-party integrations (e.g. AVS fulfillment) via declarative JSON configs with zero code changes.
• Designed and implemented Tink integration with 0Auth IBAN verification to enhance fraud prevention and account validation workflows with Adyen payByBank.
• Architected and implemented an OpenFGA-based authorization model for centralized management of users, groups, and fine-grained access control in the vendor portal.
• Architected and led delivery of the Yatta API Gateway platform using GraphQL Federation, providing a unified enterprise API layer across distributed microservices with centralized authentication, authorization and request orchestration.
• Replaced NGINX + NLB with Istio service mesh and AWS ALB; rolled out WAF, OAuth (Cognito), IP whitelisting and RBAC across environments.
• Migrated CDC from Confluent Cloud connectors to a self-hosted Kafka Connect + Debezium stack, reducing operational cost by ~80% across multiple environments.
• Implemented the Transactional Outbox pattern with Debezium for reliable, exactly-once event publishing to Kafka with Avro and Schema Registry.
• Migrated dunning/payment-recovery workflows from Airflow to Temporal, achieving 99.9% reliability for settlement handling.
• Optimised Apache Airflow with deferrable sensors to handle 1000+ concurrent DAG runs without scaling the worker pool.
• Refactored a monolithic Terraform codebase into 3 modular projects, cutting deployment time by ~45%.
• Stood up full observability with OpenTelemetry, Tempo, Prometheus and Loki; automated dev/staging/prod with ArgoCD, Image Updater and Helm.
• Collaborated with product, operations and engineering stakeholders to define scalable platform architecture and integration standards aligned with long-term business and operational goals.

maturing their API Practices on both, a Business and Technology level. My role encompasses strategy, architecture, developer advocacy as well as hands on software engineering, enabling both technical teams and business leadership to adopt and act on API- centric principles effectively. Coincidentally, we also establish GitOps, DX and Platform Best practices with this project.

Highlights:

• Aligning executives with the initiative by clarifying strategy, replacing misconceptions and myths with facts, clarifying the value of existing assets and enabling informed decision-making
• Formulating a way forward for API Lifecycle Management at OTTO
• Driving platform progress and fostering developer engagement by hands-on engineering work towards strategic goals

API Lifecycle Management, Team Topologies, Organizational Evolution, Regulatory, Platform Advocate, Developer Platform, Communities of Practice, Terraform, Kotlin, Kafka, Kong, WSO2, Apigee, Gravitee, Backstage, AsyncAPI, OpenAPI, API Design, AWS, react, nodejs, typescript, redocly, reactive programming, CDC, golang, gingonic, GitOps, DX (developer experience), stakeholder management, roadmaps, workshops, discovery.

• Architected and deployed private cloud data platform on VMware vSphere, integrating Greenplum MPP, Apache Kafka, Kubernetes, and Apache Solr, and developed real-time ingestion pipelines with Kafka Connect and Schema Registry.
• Led Oracle Exadata to Greenplum migration, rearchitected data models, optimized storage, implemented RabbitMQ with Debezium for CDC, and deployed VectorDB for Generative AI.
• Designed and executed multi-cloud migration PoC across AWS, Azure, and GCP, defined KPIs for throughput, latency, and cost efficiency, executed bulk data transfers, validated analytics and streaming workloads, and delivered full-scale architecture recommendations.
• Assessed legacy on-premises infrastructure and designed modern cloud-native data platforms using Greenplum and containerized microservices, advising on scalability, disaster recovery, and high-availability.

• Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.

• Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.

• Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.

• Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.

• Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.

• Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.

• Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.

• Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.

• Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.

• Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.

• Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.

• Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.

• Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.

• Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.

• Result: >99.5% uptime over 20+ years and zero compromises.

• Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.

• Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.

• Built and verified Zynq-7000 (Zybo Z7-10) FPGA prototypes in Xilinx Vivado – AXI IP integration, bitstream generation, hardware bring-up, timing-closure checks and waveform-based debug to confirm expected RTL behaviour.
• Set up Cadence Virtuoso schematic/simulation flows and documented settings, results and methodology for reproducible experiments – supporting structured verification and research documentation.
• Wrote Python automation for log parsing, structured data reporting and result analysis; worked daily in version-controlled Linux/Git workflows.

• Real-time tone detection on FPGA (~20 ms latency target) using a filter bank architecture with a fuzzy-logic decision stage, avoiding FFT due to its window-length/frequency-resolution tradeoff.
• Responsible for system integration and architecture.

• Designed and implemented end-to-end data pipelines (batch & streaming) using Python, SQL, and Apache Spark, Databricks on AWS reducing ETL latency by 40%.
• Developed serverless event-driven ingestion pipelines using AWS Lambda and SQS, ensuring real-time data availability for downstream analytics.
• Leveraged Google Cloud Platform (GCP) services including BigQuery and Dataflow to manage cross-cloud data warehousing and analytics integration.
• Expertise in DMS (CDC, Full Load) and Airflow for scalable data pipeline automation and orchestration.
• Managed and customized data pipelines using Databricks, Airflow. Automation using Docker, Kubernetes, Terraform.
• Automated data quality checks using dbt to modularize transformations and ensure production-grade data lineage, improving reliability by 30%.
• Collaborated with compliance teams to ensure GDPR and SOC2 alignment. Mentored junior engineers and contributed to architecture refactoring for scalability.
• Created and maintained dashboards in Power BI to provide actionable insights.

• Interim Teamlead to setup a project with STM32 and NORA Bluetooth module.
• Customer is planning new hardware to replace existing hardware with Bluetooth communication instead cable connection.
• Project was already started but the requirements were not defined.
• System based on STM32 and Nora B106 CPU.
• Analyzing the existing available code base.
• Checking for possible solutions to get the project working.
• Defining the requirements.
• Applying some rules to improve the team communication.
• Working with the NRF tools to get the custom board based on NORA B106 (NRF5340) working.
• Implementation of a simple device communication by Bluetooth.
• Preparation of documentation.
• Leading communication meetings.
• Conducted discussions with customer.
• Tools used: JIRA, OneNote, Git, Confluence, Nordic NRF, Nora B106.

• Architected and deployed a production-scale GraphRAG system using Neo4j, embeddings, and multi-hop reasoning over 120M+ nodes, improving answer precision by 32%, reducing hallucinations by 41%, and lowering retrieval latency by 38%.
• Designed and implemented an enterprise agent ecosystem using Model Context Protocol (MCP), exposing internal APIs, databases, and services as secure callable tools for autonomous workflows and system integration.
• Designed and deployed a production LLM-based email routing agent using Microsoft Graph API, MCP, and Azure OpenAI, achieving 96% routing accuracy, reducing manual triage workload by 65%, and decreasing response times from 18 hours to under 4 hours.
• Implemented autonomous agent self-correction pipelines using iterative feedback loops (Ralph Wiggum), enabling reliable error detection, automated remediation, and production-safe execution.
• Developed a multimodal semantic search platform using multimodal LLMs and vector embeddings, enabling semantic discovery across 250k+ image and video assets and improving search recall by 48%.

As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW.  Developed and implemented a holistic process view covering both technical and organizational aspects  Ensured end-to-end control of all IAM-related technical services  Established clear responsibilities and accountabilities within the IAM landscape  Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security  Introduced and monitored governance policies to ensure compliance and security  Continuously improved IAM processes and systems through regular audits and evaluations  Participated in external audits of the process as part of official ISO audits  Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units  Conceptually advanced the KPI system to measure process quality

• Conducted a comprehensive due diligence review for a potential acquisition of a Swiss manufacturing company as part of a pre-merger analysis
• Assessed production capacities and technical infrastructure
• Evaluated integration possibilities into existing business processes
• Performed risk assessment and developed recommendations for action
• Documented the findings and presented them to management

• Design of a new cloud service
• Requirements Engineering
• API Design (REST API, Kafka)
• Consulting on architecture, feasibility and effort estimation
• Implementation of a microservice architecture
• Implementation of a Spring Boot web service
• Development of REST APIs including business and persistence logic
• Kafka consumers and producers
• Various Excel upload/download scenarios
• Change Data Capture
• Cloud provisioning with IaC/Terraform
• Go-live with 30,000 users
• Operation, support and bug fixing for other services

Environment/tools: GitLab, JIRA, Confluence, IntelliJ, Spring Boot, Java, Docker, Terraform, AWS ECS, Postgres, Apache Kafka, SAP Datasphere, JUnit, Debezium, Apache POI, Hibernate, JPA, Testcontainers

• Stack: SAP Commerce 2011 (B2C).
• Migrating the data from Stibo system to SAP Commerce Cloud.
• Mapping the data from Stibo system to SAP Commerce Cloud.
• Integrating hot folders to support multiple countries and languages.
• Integrating validation tools for migrated data and generating validation reports.

• Consulting on an ongoing IT security architecture project
• Documenting past progress and planning next steps
• Applying and implementing the BSI IT baseline protection
• Building and maintaining security management systems
• Applying the ISO 27001 standard series
• Integrating ITIL processes into security architectures
• Collaborating with public clients, regulatory authorities and internal and external service providers