Disaster Recovery Expert

Red Hat OpenShift Container Platform

Scope:

• Operation and configuration of the Red Hat OpenShift Container Platform, including network, storage, and security design.
• Implementation of centralized observability solutions (Prometheus, Grafana, alerting).
• Development of CI/CD pipelines, GitOps workflows, and automation frameworks.
• Training and enablement of operations and development teams.

Result: Accelerated service delivery, transparent operational metrics, and sustainable knowledge transfer.

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

• Lead Architecture in an interdisciplinary architecture team covering enterprise, solution, NOOTS, cloud and security architecture as well as regulatory and European interoperability requirements.

• Public / Government

• Development and management of target architectures, principles, standards and technical guardrails; assessment of Security-by-Design, IAM, data protection and interface/integration architectures; architecture reviews, security assessments, risk analyses, and preparation of decision records, target visions, roadmaps and decision papers. Architectural knowledge and consideration of relevant AD-NOOTS requirements, particularly for IAM, authorization, secure integration and interoperability.

• Technologies / Methods: Enterprise Architecture, Solution Architecture, Security Architecture, Cloud Architecture, NOOTS / EU-OOTS, IAM, Authorization, Security-by-Design, API/Integration Architecture, Interoperability, Risk Analysis, Architecture Governance

• Security and integration requirements as well as technical decisions are structured in reliable architecture and decision artifacts.

Strategic consulting for the development and strengthening of ISMS structures (ISO 27001 / BSI IT-Grundschutz), including onboarding, gap analyses, and preparation of the IT organization for DORA requirements (ICT third-party risk) and NIS2 compliance. Auditing compliance requirements in a regulated environment.

Senior Security Consultant in the PHOENIX project

• Creation of security documentation according to BSI IT Baseline Protection
• Conducting BSI IT Baseline Protection checks in several languages
• Creation and maintenance of milestone plans, work packages, project plans, and project documentation
• Structural analyses, determination of protection needs, modeling, baseline protection checks, risk analyses, HiScout tool
• Consulting on information security and data protection
• Review of operating concepts

• Lead enterprise architecture, data and AI strategy initiatives across business domains, value streams, SAP, cloud, integration, process intelligence and governance, aligning transformation roadmaps with strategic business outcomes.
• Define enterprise data and knowledge strategy across business domains and enterprise taxonomy, including knowledge graph, data governance with focus on ownership, metadata frameworks, business glossaries, data product orientation, interoperability and AI-enabling architecture.
• Shape AI governance and decision-intelligence strategy using autonomous enterprise concepts, including policies, guardrails, reference architectures and knowledge-based patterns for responsible AI adoption and enterprise knowledge reuse.
• Support SAP S/4HANA cloud migration strategy and evaluate the future SAP ecosystem, including SAP BTP, Integration Suite, Business Data Cloud, SAP Analytics Cloud and Datasphere.
• Drive architecture debt management, portfolio transparency and application rationalization through architecture principles, governance models, decision frameworks and LeanIX-based Enterprise Architecture Management.
• Align business architecture and process intelligence using Signavio to connect value chains, capabilities, processes, data strategy, knowledge flows and transformation roadmaps.
• Define operating models for data governance, architecture governance, cloud, integration, API management, AI governance and knowledge sharing.
• Act as trusted advisor to executive stakeholders and business domain leaders across product, sales, finance, logistics, customer care and shared services.

• Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, Vulnerability Management Policy, Business Resilience Programme, Risk Governance Plan
• Consolidation into an integrated emergency manual (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table and a formal approval structure
• Review and documentation of the applicability of NIS2 and HinSchG, including the legal reasoning for non-applicability
• Processing of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with a documented compensating control

• Error analysis and fixes including performance optimization of the in-house developed platform API
• Change and incident management in day-to-day operations
• Responsible for compliance with security and compliance requirements
• Vendor management for software development and maintenance
• Planning and execution of migration of legacy services to a cloud native platform

Role in the project: project staff, implementation team

Used skills: requirements analysis, IT service and application management, IT operations, error analysis and performance optimization, software maintenance and lifecycle management

Project environment: Cloud Native Platform (Kubernetes, Crossplane, AWS, ArgoCD, Grafana)

Enterprise & Cloud Security Architect supporting the modernization of the SDK application landscape as part of the KVNeo transformation program. Responsible for enterprise architecture, cloud governance, security architecture, and the definition of technical standards for strategic business applications.

Key responsibilities include architecture governance, target architecture development, cloud and integration architecture, security-by-design, and the translation of regulatory requirements into sustainable technical solutions across multiple business domains.

Responsibilities and achievements

• Designed and reviewed target architectures for strategic insurance applications and enterprise services.
• Developed architecture documentation based on Arc42 and Architecture Decision Records (ADRs).
• Defined governance models, architecture principles, and technical guidelines for cross-domain initiatives.
• Supported the modernization of archive, document management, and output management platforms.
• Designed integration architectures using REST APIs and event-driven communication patterns.
• Led architecture discussions with enterprise architects, development teams, product owners, and business stakeholders.
• Translated regulatory requirements such as DORA and ISO/IEC 27001 into practical architecture decisions.
• Designed security concepts covering Identity & Access Management, authorization, authentication, auditability, and logging.
• Supported SIEM integration, security monitoring, and enterprise logging concepts.
• Evaluated technical risks, technical debt, and architecture improvements while providing decision papers for architecture boards.
• Established architecture governance processes and contributed to enterprise-wide transformation initiatives.
• Supported cloud governance activities and the definition of secure cloud architecture standards.
• Facilitated architecture workshops and coordinated cross-functional stakeholders across business and IT.

Technologies & Methods Microsoft Azure • Arc42 • Architecture Decision Records (ADR) • REST APIs • Event-Driven Architecture • Microsoft Entra ID • Active Directory • IAM • SIEM • Cloud Governance • Enterprise Architecture • Security Architecture • Azure API Management • Jira • Confluence • Draw.io • DORA • ISO/IEC 27001 • Agile • Scrum

• Onboarded and conducted comprehensive documentation and system analysis to assess the existing data infrastructure, facilitating rapid integration and collaboration across functional data teams (modelling, processing, reporting).
• Collaboratively defined the architecture and project structure for a central data pipeline repository, including hierarchical standards, knowledge management strategies, and role-specific responsibilities, enhancing maintainability and onboarding speed.
• Evaluated and validated open-source data routing tools (Airbyte, Apache NiFi, Dragster) for ingest and sync requirements in retail analytics, including local benchmarking and error-state testing.
• Led the design and deployment of Airbyte in Kubernetes, creating customized Helm charts, securing secrets handling, and configuring Ingress with TLS and internal DNS routing, ensuring full API and UI accessibility.
• Troubleshot and resolved Ingress controller issues, iterating through multiple stages of debugging and testing, and documented setup and replication steps for scalable reuse.
• Mapped data models to ARTS standard, supporting schema alignment for ERP and reporting use cases, and coordinated review loops to align future data processing logic.
• Drafted strategic 1-pagers comparing MinIO, Pub/Sub, and routing architectures, providing technical guidance for architectural decisions and investment planning.
• Enabled secure access and authentication mechanisms, including initial evaluation for SAML integration, cluster-level configuration reviews, and service annotation improvements.

• The goal of the project is to build a Greenfield FailSafe data center (FSRZ) as an emergency measure in accordance with BSI 200/4 against a cyberattack.
• Recovery of a project that had been running for several years. Re-initialization of the project: adjustment of the project organization, initiation of regular meetings, establishment of project controlling and project reporting, introduction of project risk management and consolidation of project documentation. Establishment of project governance and introduction of decision-making structures based on decision papers. Definition of deliverables and derivation of phase plans and the project plan. Personnel and resource planning. Coordination with “neighboring projects”, initiation of concept development and implementation. Management of the project with 8 subprojects and PMO. Budget planning and controlling (14,8 Mio). Support and coaching of the subprojects in their methodological approach. Coordination with suppliers and support of EU tenders. Coordination and processing of change requests. Coordination with line management regarding the economically viable operation of the FSRZ. Technical support for IT architecture in the areas of zOS, Windows and Linux, networking and IT security, for designing interim operations and extended regular operations for the FSRZ, planning emergency processes and emergency communication internally and externally.

• IaC & Automation: Designed and automated provisioning of about 40 Linux servers and cloud resources using Terraform and Ansible (reducing manual effort by over 80%).
• Container Orchestration: Built and operated two production Kubernetes clusters with 70+ Docker containers to ensure high availability, scalability, and self-healing.
• CI/CD Optimization: Developed and maintained 15+ CI/CD pipelines with Jenkins and GitHub Actions (shortening deployment times from several hours to under 15 minutes).
• OS Hardening & Operations: Automated patch management, OS configuration, and security hardening for 40+ Linux servers with Ansible to improve compliance.
• Monitoring & Alerting: Implemented centralized monitoring and alerting solutions for proactive issue detection and minimized system downtime.
• Cross-Functional Collaboration: Worked across Dev, Ops, and Security teams to establish DevOps best practices and infrastructure-as-code standards.

• Infrastructure management with Puppet and Terraform for consistent environments
• Maintenance and adaptation of Terraform scripts for Azure cloud deployment
• Migration of database systems and services to the Azure Cloud
• Introduction of GitOps with ArgoCD for fully automated deployments
• Adaptation and development of GitHub pipelines for CI/CD workflows
• Creation of Helm Charts for standardized deployments
• Migration of repositories from Bitbucket to GitHub
• Operation and performance optimization of an Oracle 19c Grid cluster (RAC, Dataguard)
• Setup and management of MongoDB instances (on-premise and Azure Kubernetes)
• Setup of PostgreSQL clusters in on-premise and Azure Kubernetes environments
• Migration of services, master data, and stored procedures from Oracle to PostgreSQL
• Troubleshooting and performance tuning of complex data infrastructures
• Installation, configuration, and upgrade of Tableau in the productive BI environment
• Development of sanity checks to monitor business processes and application logic
• Adaptation of the backup and recovery strategy to new requirements
• Execution of disaster recovery and point-in-time recovery
• Technologies used: Oracle 19c RAC Grid Dataguard, PostgreSQL 16, MongoDB, MySQL Cluster, Kubernetes (Azure), Tableau, Puppet, Terraform, ArgoCD, GitHub/Bitbucket, CheckMK, Prometheus, Grafana, Icinga2, Ubuntu/RHEL

• Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.

• Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.

• Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.

• Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.

• Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.

• Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.

• Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.

• Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.

• Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.

• Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.

• Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.

• Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.

• Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.

• Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.

• Result: >99.5% uptime over 20+ years and zero compromises.

• Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.

• Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.