Cloud Native Experts in Munich

• Modernization of a large-scale Java enterprise application*

The project is modernizing a complex enterprise application that has grown over many years. The existing Spring-based legacy system runs on Java 8, OSGi, and Eclipse RCP and is being gradually migrated to a modern, maintainable architecture with Java 25 and Quarkus.

Marcus works on analysis, architecture, refactoring, and implementation. One focus is on untangling historically grown structures and dependencies and on building a clean, sustainable Java and Quarkus technology stack.

Tools & technologies: Java 8, Java 25, Quarkus, Hibernate ORM with Panache, EclipseLink, OSGi, Eclipse RCP, Maven, JUnit, Mockito, REST, JSON, Git, Eclipse IDE, IntelliJ IDEA Ultimate, Jira, Confluence

• AI Integration (LLM & RAG): Designed and built an internal intelligent RAG system (Retrieval-Augmented Generation) based on LLMs, n8n, and vector data to automatically analyze technical documents and error logs.
• Design & Implementation: Designed a robust RS-232/UART communication interface for an SBC-based embedded device used to control medical shaker systems.
• Architecture & Protocol Design: Built a highly maintainable software structure (OOP, SOLID) and defined resilient, hardware-level communication protocols, including multithreading and advanced error handling.
• Quality Assurance & DevOps: Automated testing with xUnit, ran integration tests directly on the hardware target, and maintained technical documentation to strict medical technology standards via Azure DevOps.

Label: C#, .NET, LLMs, RAG, n8n, RS-232, UART, Multithreading, async/await, xUnit, gRPC/protobuf, Blazor, MudBlazor, EF Core, Visual Studio 2026, Azure DevOps

• Designing the audit logging framework
• Implementing APIs for developers to integrate in their codebase
• Implementing ingestion pipeline, database query layer and UI for browsing the audit events
• Improving stability and reliability of the backend system

In my role as Senior Cloud DevOps Architect for BP, an oil and gas company, I had the mission to migrate the Electric Vehicle Charging platform of the EV Division from on-premises and Azure to AWS cloud, resulting in a hybrid multi-cloud, multi-tenant SaaS solution.

Deployment with Kubernetes for the application layer meant provisioning Kubernetes clusters managed by EKS and AKS, with a focus on integrating them into a multi-tenant environment. This integration was achieved by using Kubernetes namespaces and access controls to ensure data isolation and privacy enforcement.

In the database layer, we chose an RDS instance with PostgreSQL to support the backend infrastructure of our applications. Tenants shared the same RDS instance, but each had a dedicated schema.

To ingest near real-time data from physical charge points (CPOs), as IoT devices, via the OCPI protocol, we ran into significant delays with batch processing. As a result, we built a real-time streaming data pipeline using Apache Kafka, while prioritizing an event-driven architecture.

Led collaboration across multiple internal teams, external vendors, cloud providers, and on-site partners to integrate over five systems into a unified solution.

Achievements:

• Successfully designed and implemented hybrid multi-cloud solutions, integrating multiple cloud platforms (AWS, Azure) with on-premises infrastructure, using Site-to-Site VPNs, Firewalls, and Load Balancing.
• Led the migration of on-premises infrastructure to multi-cloud, multi-tenant infrastructure, resulting in 30% faster processing times.
• Migrated workloads from VMware and Hyper-V environments to cloud-based VMs, leveraging cloud-native services to optimize performance, cost efficiency, and scalability.
• Designed a multi-tenant Kubernetes platform leveraging the Kubernetes ecosystem, using Karpenter for dynamic EC2 node provisioning, KEDA for event-driven pod autoscaling (e.g., Kafka message lag), and Rancher for centralized monitoring of multiple clusters (EKS, AKS, or on-prem K8s), replacing Microsoft-centric Azure Arc management service.
• Designed and implemented Python-based FastAPI microservices as part of the EV core-backend on AWS EKS application layer, powering data ingestion and customer analytics pipelines.
• Developed asynchronous, event-driven APIs (Python-FastAPI) for real-time integration with CPOs, supporting OCPI 2.3 and OICP protocols.
• Designed and implemented a secure, production-grade Azure Databricks platform using Terraform, ensuring scalability and cost efficiency.
• Migrated on-premises ERP to a hybrid Dynamics 365 architecture with ERP hosted locally and CRM running in Azure, integrated via Azure Arc.
• Automated CI/CD pipelines for Databricks notebooks and jobs using GitHub Actions & Databricks CLI, reducing deployment time. Reduced infrastructure provisioning time by 70% by automating cloud resource deployment with GitOps.
• Ensured compliance with internal audit and data governance standards (GDPR) through OAuth2/OIDC-based authentication and fine-grained role-based access controls.
• Developed a Zero Trust security model, enforcing least-privilege access and microsegmentation, enhancing security posture and compliance with GDPR and NIST.
• Built interactive analytics dashboards in Amazon QuickSight, integrating data from S3 and Redshift to deliver real-time business insights and visualizations with embedded access for multi-tenant users.
• Led cloud security assessments and full-lifecycle cybersecurity integration during M&A, covering AWS, Azure, IAM (Entra ID), and data protection, while aligning security posture with NIST, ISO 27001, and GDPR across hybrid and cloud-native environments.
• Reduced cloud costs by 64% for a client's dev environment by implementing automated start/stop schedules for EC2 and RDS instances via AWS CDK with EventBridge Scheduler or AWS Systems Manager.

Tech stack:

• Infrastructure as Code: Terraform, AWS CDK, Ansible.
• Containers: Kubernetes on EKS, AKS, Docker.
• Streaming Data Processing: Kafka to Confluent Cloud, after AWS MSK.
• Frontend: TypeScript, React, NextJS, Hooks, Styled Components.
• Backend: Python with FastAPI, also Node.js with NestJS.
• Database: Aurora on PostgreSQL with TypeORM, RDS on SQL Server, Azure Databricks full setup and administration, ETL Pipelines.
• CI/CD and GitOps: GitHub Actions, Azure DevOps, ArgoCD.
• Monitoring and Observability: Prometheus and Grafana.
• Virtualization: Hyper-V, VMware Cloud on AWS, Azure Migrate.
• ERP Systems: Odoo, Microsoft Dynamics 365 Business Central on Azure, integrated with Azure Arc.
• Networking: Site-to-Site VPNs, AWS Direct Connect, Azure ExpressRoute, Firewalls (AWS Network Firewall, Azure Firewall).
• Security: IAM, NIST Framework, Zero Trust Security, AWS WAF, AWS Shield, GuardDuty.

• Partner directly with C-level leadership (CEO, CAIO, CTO) on architecture, OKR strategy, and cross-team roadmap prioritization, translating strategic goals into structured engineering requirements.
• Surfaced and mapped technical debt across the entire organization with C-level leadership and co-defined a prioritized remediation strategy, balancing debt paydown against feature delivery.
• Led code reviews and technical standards across the team, fostering a mentor-first environment with two-way feedback dialogue — pairing on complex pipeline work and unblocking junior engineers on async architecture patterns.
• Re-architected the AI companion's core processing pipeline from synchronous to asynchronous with a queue-based worker architecture, enabling horizontal scalability and cutting upload processing time ~4x (from ~22s to 5–10s) while improving response accuracy.
• Designed an AI-driven document intelligence workflow with automatic multi-document classification, per-document summarization, and relevance guardrails for the patient care journey.
• Built a unified patient memory system (short- and long-term context) bridging the document vault and chatbot into a single bidirectional, context-aware platform.

Conducted an independent technical assessment of an AI-enabled software platform, combining AI risk auditing, cybersecurity analysis and software architecture review. Reviewed application components, APIs, data flows, LLM integrations, retrieval-augmented generation, multi-agent orchestration, authentication, tenant isolation, dependency vulnerabilities, AI governance and model lifecycle controls. Authored a technical audit report with a structured risk register, source-code evidence, regulatory references, corrective actions, AI system inventory, risk classification, remediation roadmap and Key Risk Indicators.

Technologies: TypeScript, JavaScript, React, Next.js, Node.js, REST APIs, MongoDB, Redis, AWS serverless services, OAuth 2.0 / OpenID Connect, LLM APIs, RAG, vector search, multi-agent orchestration, Model Context Protocol, C4 architecture modelling, threat modelling, NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, OWASP guidance, MITRE ATLAS

• Responsible for Openshift/Kubernetes on-prem administration and developer support.
• Developed URP infrastructure automation with Python, Ansible, Kustomize and ArgoCD, Argo Workflow/Events stack.
• Wrote smoke and load tests for URP infrastructure utilizing Python, Kustomize and ApplicationSets.
• Helped to set up and deploy URP infrastructure in Google Cloud, GKE.
• Set up monitoring for URP and ArgoCD stack with Splunk Cloud.
• Performed system administration tasks across RedHat Linux, Kubernetes/Openshift, ArgoCD, GitLab, Bitbucket Enterprise, Kafka and MongoDB.

• Lead Architecture in an interdisciplinary architecture team covering enterprise, solution, NOOTS, cloud and security architecture as well as regulatory and European interoperability requirements.

• Public / Government

• Development and management of target architectures, principles, standards and technical guardrails; assessment of Security-by-Design, IAM, data protection and interface/integration architectures; architecture reviews, security assessments, risk analyses, and preparation of decision records, target visions, roadmaps and decision papers. Architectural knowledge and consideration of relevant AD-NOOTS requirements, particularly for IAM, authorization, secure integration and interoperability.

• Technologies / Methods: Enterprise Architecture, Solution Architecture, Security Architecture, Cloud Architecture, NOOTS / EU-OOTS, IAM, Authorization, Security-by-Design, API/Integration Architecture, Interoperability, Risk Analysis, Architecture Governance

• Security and integration requirements as well as technical decisions are structured in reliable architecture and decision artifacts.

AI Assistance and Target Vision for Partially Autonomous Energy Portfolio Management

Building an AI control layer directly on the up-to-date daily live portfolio of a large energy provider — not as an isolated pilot, but as an operational extension of the existing DB1 and portfolio management. The goal is the gradual development from assistance through monitoring/alerting to analysis agents with Human-in-the-Loop approvals, supplemented by a role-specific System of Engagement alongside the BI System of Record. At the same time, the business case, target vision and management pitch compared with static monthly reporting are being developed.

• AI control layer: Design and build on the existing live portfolio data product (several million contracts) — development stages assistance → monitoring/alerting → agents with Human-in-the-Loop approvals.
• LLM-supported data analysis: Semantic queries, SQL/tool integration and additional RAG components based on portfolio, plan-versus-actual and data quality data (Azure OpenAI, Snowflake), with drill-downs to individual contract level.
• Analysis agents: Multi-stage agents for variance and driver analyses of churn, price adjustments, volumes and procurement costs.
• Views concept: Role-specific interfaces for business units, management and C-level as a System of Engagement alongside the BI System of Record.
• Business case & pitch: Target vision and cost-benefit argumentation compared with static monthly reporting.
• LLM setup (privacy & security): Coordination with IT Security and Data Protection — EU region, data separation and approval processes.
• Agent architecture: Multi-stage agent pipelines (analysis → validation → summary) with documented data sources, tool calls, review steps and source references for each statement.
• Data foundation: Built on the up-to-date daily DB1 data product (Snowflake, dbt) — portfolio, plan-versus-actual and data quality metrics as the common basis for all AI analyses.
• Guardrails & evaluation: Evaluation and approval processes for LLM responses relating to management-relevant statements — test sets, metrics and human review.
• Prototyping & validation: Iterative validation of agent responses with the business unit — test question catalogue, feedback loops and response quality for each release.
• Roadmap & development stages: Detailed stages from assistance → monitoring/alerting → partially autonomous management, including transition criteria and governance for each stage.
• Integration: Integration into the existing BI and data landscape — BI remains the System of Record, while the AI layer provides interactive drill-down paths as the System of Engagement.
• Enablement: Enablement of business users — prompting guides, training and an operating model for ongoing use.
• Management: Coordination of business units, Data Engineering, IT Security and Data Protection.
• Change Management: Communication and expectation management with business units and management throughout the development stages.

Results:

• Built on an existing up-to-date daily data product with several million contracts
• Established an LLM setup coordinated with Data Protection and IT Security in the EU region, including data separation and approvals
• Defined three development stages through to partially autonomous management
• Designed role-specific views for business units, management and C-level
• Developed the business case and management pitch for the development stages
• Established an iterative response-quality validation process with the business unit
• Designed the operating model for assistance operations and initiated validation

Stack: Azure OpenAI, Azure AI Foundry, Snowflake, dbt, React, TypeScript, Entra ID, RAG, Agentic AI, analysis agents, Human-in-the-Loop, Prompt Engineering, LLM Evaluation, LLMOps, GDPR / EU region, Azure DevOps, Python, SQL, Change Management

• Overall responsibility for the project lifecycle from scope definition to completion
• Close collaboration with platform teams, IT leaders, and external service providers
• Application of SAFe principles and structured sprint work
• Creation of a migration roadmap with clear milestones
• Monitoring of the lifecycle: onboarding, repository migration, replication of permissions, and system tests
• Visualization of the architecture with PlantUML and Gliffy as well as documentation in Confluence
• Regular status reports and running knowledge transfer sessions

• Independently carried out integration, testing, and acceptance activities on 5G core systems in a containerized test environment; structured test protocols and documentation
• Built a 5G core and RAN integration environment from scratch (Docker Compose) for reproducible test scenarios across multiple vendor configurations
• Performed fault analysis and troubleshooting across the entire protocol stack (SBI, RRC, NAS, NGAP, TLS) to precisely isolate integration issues
• Contributed to the BSI-related NESAS-CCS-GI evaluation project – experience in security-critical, regulated customer projects

Project: Tax Exemption Order Application

The client has an existing application for creating and maintaining tax exemption orders for end customers; design and implementation of a comparable application for internal employees.

• Design and implementation of microservices and the UI for the business area "tax exemption orders" using Domain Driven Design as well as Spring Boot and Angular.
• Implementation of reactive, non-reactive, and asynchronous APIs (Spring REST, WebFlux, GraphQL).
• Development of the Angular application, including state management using Signals, RxJS Observables, and subscriptions.
• Securing the API and the application using OAuth2, JWT, and OpenID Connect.
• Configuration and setup of CI/CD pipelines with Jenkins.
• Collaboration with cross-functional teams and conducting code reviews.

Environment: Java, Spring Boot, Angular 18 & 19 (standalone, signals), RxJs, Bootstrap CSS, Vitesting, OpenShift, Istio, microservices, Kafka, Dynatrace, Jenkins, GitLab, Graylog, Sonar, Oauth2, OracleDB

• Participated in the gradual modernization of components into cloud-native 12-factor applications.
• Worked closely with the business operations team to eliminate manual processes and resolve several performance bottlenecks.
• Designed and implemented a CI/CD pipeline to increase developer productivity, enforce quality and security checks, and automate product delivery.
• Migrated several components into the OpenShift Kubernetes cluster.
• Built a monitoring stack from scratch with Prometheus and Grafana to monitor services running in OpenShift.
• Developed dashboards in both Grafana and Splunk for operational transparency.
• Implemented an OIDC/OAuth2-based single sign-on (SSO) solution with Keycloak to secure multiple applications.
• Technologies: Java, Spring, Quarkus, Kafka, MySQL, Cassandra, Redis, Spring Data, Hibernate, Docker, Kubernetes, OpenShift, Keycloak, OIDC, OAuth2, Helm, Prometheus, Grafana, Splunk, Spark.

• Agile development of a multimodal analysis platform for training materials (video, audio, documents) using Scrum
• Extraction of context-relevant content based on user profiles & competency dimensions
• Personalized delivery of learning content to improve sales performance
• Close coordination with sales teams & stakeholders to validate features
• Use of Gemini, Whisper, Python & JavaScript, deployment on AWS, Perl for scripting data imports
• Integration into existing tools & CRM systems for smooth adoption
• Technologies used: Python, OpenAI, DB tech such as PostgreSQL, CI/CD for AirFlow DAGs, FastAPI