DHCP Experts in Germany

• Creating concepts and architecture for domain integration (SEAT into the VW structure)
• Domain trusts and administration
• Operation and administration of Windows 2022/ 2025 servers and domains
• Domain restructuring
• GPO and SG editing and migration
• DNS restructuring and migration

Technologies: Windows 2022, Active Directory, ADFS, AD Azure Connect, DHCP, DNS, GPO, VMWare vSphere, Hyper-V, Powershell, Jira, MS Office 365,), SCCM, VSAN Fileservices, Approximately 800 servers, 400 users

As part of preparing and providing operational support for a company succession:

• Company analysis: Analysis of the overall economic, organizational and structural situation (current status, strengths/weaknesses, potential risks)
• Process analysis: Recording and documentation of all relevant business processes (BPMN, UML) in the areas of management, finance, purchasing, sales and operations
• Process optimization: Identification of weaknesses and inefficiencies, development and operational implementation of improvement measures
• Stakeholder management: Identification and analysis of all relevant internal and external stakeholders; structured communication and coordination with former and future owners, shareholders and employees
• Change management: Supporting employees and management throughout the handover process; building acceptance and trust among all parties involved
• Governance & documentation: Preparation and handover of structured operating manuals, process documentation and an organizational manual for the new business owner
• Risk & weakness analysis: Assessment of operational and strategic risks in the handover process and development of recommendations for action
• Operational support: Interim assumption of management responsibilities; ensuring business continuity during the transition phase

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

• Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
• Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
• Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
• Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
• Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
• Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.

Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin

• Administration and further development of the M365 environment, including Teams, Exchange Online, Intune, and SharePoint Online
• Development of dashboards for performance monitoring with Microsoft Power BI
• Implementation of user requirements and processes with low-code/no-code technologies (Power Apps, Power Automate)
• Use of Jira and Azure DevOps to plan and implement user stories in an agile project context
• Participation in daily stand-ups, sprint planning, sprint reviews, and retrospectives as the technical point of contact
• Planning and implementation of security policies using Azure Conditional Access and multi-factor authentication
• Configuration and deployment of clients and applications via MECM (SCCM) and Baramundi

Conducting a GAP analysis to assess existing security measures → identifying critical vulnerabilities

Developing an action plan that takes risk and cost-effectiveness into account

Introducing an IT maturity model based on BSI guidelines

Advising management on compliance, governance, and security strategy

Establishing internal processes for a sustainable security organization

• Delivery of various end-customer projects in server and network infrastructure on time, in quality, and within budget.
• Project 1: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall at an automotive supplier.
• Project 2: Migration of file services from dedicated servers at 5 branch locations into a central managed file service, including DHCP, directory, and print services, as well as decommissioning of the old domain controllers.
• Project 3: Renewal of the network infrastructure at the headquarters and branch locations of a logistics company and transition of the LAN, WLAN, and firewall environments into a managed network service.
• Project 4: Network renewal, replacement of the core and access switches at the headquarters of a medical technology company and transition into a managed network service.
• Project 5: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall for a city.
• Environment: ASA and Fortinet firewalls, Cisco network components, ITSM Heat/Ivanti, Confluence.

• Error analysis and fixes including performance optimization of the in-house developed platform API
• Change and incident management in day-to-day operations
• Responsible for compliance with security and compliance requirements
• Vendor management for software development and maintenance
• Planning and execution of migration of legacy services to a cloud native platform

Role in the project: project staff, implementation team

Used skills: requirements analysis, IT service and application management, IT operations, error analysis and performance optimization, software maintenance and lifecycle management

Project environment: Cloud Native Platform (Kubernetes, Crossplane, AWS, ArgoCD, Grafana)

• Focus on winning new enterprise IT projects and further developing the IT Service and Application Management profile
• Available for new projects in Application Management, IT Service Management and Application Operations

Task:

• Design and build a proof of concept (PoC) for a future-proof virtualization platform, taking secure system architectures into account
• Assess the current state of existing infrastructures and develop selection and evaluation criteria for the right OS virtualization platform
• Carry out the requirements analysis and then create and prioritize tickets in the ticket system
• Complete and continuously update a tool evaluation matrix based on PoC results
• Support team knowledge building through clear documentation of the approach and results in Confluence
• Enterprise analysis of existing hardware (creating different BoMs)

Technologies: Vmware, Vmware Aria Operations, Osism, Canonical OpenStack, FishOs, Linux, Terraform, Ansible, Confluence, Alma

• Conceptual consulting for securing business processes
• Consulting for planning and implementing IT and IT security projects
• Security and policy checks, process optimization, contingency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept and for Digid GmbH.
• 2025: Consulting for a customer after a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations for increasing IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Preparation of a DNS concept including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Preparation of a DHCP concept including consulting on DHCP design, the central DHCP management system and automation. Consulting on the operation of the products mentioned, operating processes, and adapting the IT documentation and IT service description for Thyssenkrupp Marine Systems.
• 2024: Analysis and assessment of the network and security infrastructure established by the providers with regard to the overall architecture, consisting of the design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the results, their causes and possible solutions to C-level management, including the required decision templates. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on Zero Trust, redesigning a Cisco ISE implementation and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Bundesanstalt für Geowissenschaften und Rohstoffe (until 05/2023) and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Preparation and review of white papers for infrastructure and security architectures, planning new network infrastructures for Deutsches Luft- und Raumfahrtzentrum.
• 2022: Development of a concept for the technical and process-related modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, introducing Network Access Control and conducting an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for Bundesagentur für Arbeit.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including evaluation and preparation of recommendations for remediation, taking risk and probability of occurrence into account, for customer ifi GmbH.
• 2021: Consulting, concept development and sub-project management for introducing a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic assignment of endpoints) in office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure consisting of the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks and wireless LAN, including support during implementation, for Bundesanstalt für Geowissenschaften und Rohstoffe.
• 2021: Creation of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level-3 policies and preparation of process instructions for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of outsourcing the LAN/WLAN infrastructure to a managed service provider and preparation of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the “Transition of SIEM/SOC Services” project of a customer into a shared environment and assumption of the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop for a future implementation of Mobile Device Management at customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for introducing a rule management tool for firewalls and recertifying NAC endpoints based on 802.1x and MAB at customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recording and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture with regard to the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Development of recommendations to improve the stability and operation of the infrastructure. Preparation of a network segmentation concept and project management for implementing the measures from the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Analysis of the current IT architecture of all 23 companies.
• Recommendations for optimizing the IT infrastructure and preparation of a comparison between a classic perimeter security concept and the Zero Trust model.
• Preparation of a security zone concept.
• Preparation of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the Cyber Security program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network Segmentation and Access Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of offers.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on introducing and initially operating an ISMS based on ISO27001.
• Auditing the IT environments of the GLS country companies.
• Analysis and assessment of IT security risks and derivation of required measures.
• Development of proposed solutions in coordination with the relevant stakeholders.
• Project management and transition of the ISMS to later operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Nationwide strategic and conceptual consulting for major enterprise customers and financial and insurance customers on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and implementation of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Preparation of security policies based on ISO 2700x.
• Assumption of the interim role of Information Security Officer.
• 2017: Preparation of a contingency concept for VPV Lebensversicherungs-AG.
• Review and update of the IT contingency manual.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Preparation of detailed-level designs for cloud products.

• Understand the customer’s business & technical requirements and translate them into system / technical requirements
• Design and implement Schrodinger’s applications on cloud systems, and experience convincing senior management and senior technical staff of the benefits of their journey with Schrodinger on the cloud
• Provide exceptional technical design and thought leadership, especially around AWS, GCP, and K8s architecture reviews, performance, high availability, cost, and security
• Deep understanding of the Well-Architected pillars and all best practices for building a secure, performant Schrodinger’s applications on the cloud platforms
• Lead technical workshops and advise customers on architectural and strategic IT decisions
• Ensure success in designing, building and migrating applications, software, and services on the cloud platforms
• Educate customers on best practices to ensure their solutions are designed for successful deployment in the cloud
• Work with other team members to ensure quality and customer success
• Define the tickets, tasks, and timelines of projects
• Collaborate with account managers to ensure that the projects are executed according to the defined plan and timeline
• Monitor the progress of the projects, identify risks and issues, and take proactive measures to mitigate them
• Lead and inspire cloud architect teams, provide guidance, and make critical decisions
• Facilitate effective communication and collaboration among team members
• Collaborate with Schrodinger’s managers to improve deployment, support, and configuration of Schrodinger’s applications
• Lead weekly standups and define priorities

• Design and build of a fully isolated AWS offline environment with no outbound internet access for running a browser-based business application
• Design and implementation of a proxy and response service that terminates all external application calls inside the VPC and serves them from locally stored content; identification of the actual communication needs through measurement-based DNS query logging
• Creation of architecture designs and decision papers including a comparison of options (Application Load Balancer with Lambda and S3, reverse proxy on EC2, private API Gateway) assessed by operational effort, cost, and availability
• Transfer of the solution and operations documentation previously available only for Azure to an AWS target architecture, including reassignment of all services and operational processes
• Automated rollout as Infrastructure as Code (Terraform, CloudFormation) with CI deployment via GitHub Actions, plus setup of private DNS zones and an internal certificate chain for operation without internet access
• Creation of architecture, deployment, and operations documentation and handover to the customer
• Build-up of a private cloud platform on OpenStack at provider TelemaxX with Terraform, including FortiGate HA clusters, FortiManager, and Kubernetes
• Introduction of Policy as Code (Open Policy Agent, Conftest) as well as development of MCP servers (Model Context Protocol) to connect AI assistants to operations and project tools

Successes:

• Made the business application fully operable without internet access for the first time; the cause of the loading error was narrowed down systematically to missing CORS headers after the likely certificate issue was ruled out
• Fully transferred an existing Azure concept to AWS and replaced the manually created environment with a reproducible, CI-based rollout

Technology stack: AWS (VPC, Application Load Balancer, Lambda, S3, Route 53 private hosted zones and Resolver query logging, IAM, CloudWatch, EC2, CloudFormation), Infrastructure as Code (Terraform, CloudFormation, Remote State), CI/CD (GitHub Actions with OIDC, Azure DevOps Pipelines), OpenStack, FortiGate, FortiManager, Kubernetes, Policy as Code (Open Policy Agent, Conftest), offline and air-gap architectures, PKI & certificates (internal CA, TLS, CRL/OCSP), DNS, network segmentation, Linux, Windows Server, Python, Bash, PowerShell, YAML, JSON, architecture design & decision papers, documentation (Confluence, Markdown), Generative & Agentic AI (Model Context Protocol, Agentic AI Coding Tools)

• Processing and coordination of IT tickets (Helix, Omnitracker) incl. VIP support and remote support (Microsoft Teams, RDP, FastViewer)
• Onsite support at the main location as well as support for modern conference and meeting room technology (e.g. MeetingBoard 75 Pro)
• User and rights management in Active Directory (Active Roles), Azure AD, Exchange and MDM
• VDI support and monitoring with Citrix Director and Aruba Networking
• Endpoint management and policy administration via Ivanti
• Deployment, configuration and lifecycle management of clients (Dell notebooks, iPhones, iPads)
• Hardware rollouts for new employees incl. shipping across Germany
• Asset and license management as well as organization of site migrations