Checkmarx Experts in Germany

• Lead programmer, architect and deputy product owner
• Completed transition from zPDV to STEP
• Ensured quality of C++ and Perl sources through automated and manual checks
• Supported resolution of incidents and errors in testing
• Implemented batch for supplementary assignment of payment run numbers
• Implemented batch for distribution of SGB 2 information to the central payment unit
• Supported replacement of Solaris with Linux
• Upgraded gcc from 7.4 to 9.3
• Programmatically generated Makefiles from Borland projects for builds
• Extended funding data with new attribute “Kennzeichen Fahrtkosten Praktikum”
• Programmatically generated XSD and WSDL files from IDL definitions
• Represented the product owner when needed
• Implemented batch for one-time payment processing
• Developed generator for Liquibase files
• Implemented and maintained regular anonymization of production data
• Supported migration from SLES 12 to SLES 15
• Supported introduction of mutual TLS
• Implemented batch for sending deletion impulses to EDA BE
• Organized script directory structure
• Investigated potential introduction of String-Latin and implemented minimal solution
• Remediated security findings identified by CheckMarx
• Supported PAP recalculations and general change notices
• Converted ERP interfaces from SOAP to REST
• Planned technical and business topics such as register modernization, cash register security, training costs, four-eyes principle

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Successful implementation of vulnerability management with DefectDojo
• Consulting and implementation of technical and process-related aspects of vulnerability management with DefectDojo
• Consulting on the implementation of a secure software development lifecycle
• Skills: Gitlab, DefectDojo, Vulnerability Management, SCA, SAST, DAST, Python, Kubernetes, ArgoCD, Docker, AWS, Azure, Whitesource/Mend, Greenbone

• Head of overall technical integration NSC (National Secure Cloud, project with approx. 60 employees).

• Technical integration of all subprojects into one product, definition of interfaces and basic components of a cloud including hardware, technical architecture of the IABG platform.

• Development of a Cloud Management Platform (CMP) capable of creating private/mixed clouds of any complexity based on a textual description with one click or interactively.

• CMP also includes the complete hardware management lifecycle.

• Kubernetes, OpenStack and Hadoop are used as the foundation.

• The management layer includes Harbor, Gitea, Longhorn, Keycloak, Rancher and Jenkins, which are configured automatically.

• Private cloud can run any customer workloads, including a full Hadoop layer with HDFS, Spark, MapReduce, Mesos, HBase and around 20 additional ML/DL technologies.

• Hadoop worker clusters can also be installed automatically without Kubernetes on bare metal or commodity hardware.

• OpenStack with Nova, Neutron, Ironic, Swift, Cinder, Ceph.

• Development of a Java application Rudi: SOAP, REST, containers, DB.

• Technologies: Kubernetes (K3s, Rke2, Minikube, Harbor, Gitea, Jenkins, Longhorn, Keycloak, Rancher), OpenStack (Nova, Neutron, Keystone, Swift, Ceph, Cinder, Sahara, Magnum, Kayobe, Kolla, Bigrost, Ironic), Hadoop (HDFS, Ambari, Solr, Livy, Ranger, YARN, Tez, HBase, Kafka, Hive, Zookeeper, MapReduce, Spark, Oozie, Flink), virtualization (Kubernetes (K3S), VMware, Oracle), scripting (Ansible, Puppet, Juju, Shell, Groovy, Gradle, Maven).