Encryption Experts

Creation of concepts for M365 implementation, especially Tenants, EntraID, EntraConnect and ExchangeOnline, taking BAS standards into account (mandatory baseline security requirements) in the project "Concept M365" with the aim of transferring the concepts to the M365 environments of Bitmarck and then handing them over to the customer.

• Creation of a current-state analysis of the existing M365 environments as well as the on-premises environments and the BAS standards.
• Creation of concepts for the topics Tenants, EntraID, EntraConnect and ExchangeOnline taking the BAS standards into account
• Design and implementation of an automated solution for creating standardized M365 tenants based on Microsoft M365 DSC (Desired State Configuration)
• Transfer of the concepts into the M365 environments
• Creation of detailed technical documentation

• Operation and further development of the network and security infrastructure.

• Monitoring, analysis and resolution of network and security incidents.

• Cross-department collaboration with other specialist teams for operations, further development and reporting.

• Firewall vulnerability analysis.

• Firewall rule approvals.

• Troubleshooting IP communication issues in the network and firewall infrastructure.

• Security-critical IT infrastructure, processing of personal data, compliance with legal regulations.

• Products: Palo Alto Networks Firewalls, Cisco ACI, Checkpoint Firewalls, F5

• Technologies: SDN, SDWAN, Cisco EPIC, Cisco ACI

• PMO lead for Security Clearance 2 (SÜ2) cleared
• Reporting to sub-program management GMN
• System maintenance 25+
• Functional control and coordination of Jira setup
• Preparation of decision papers (e.g. project planning, steering model, communication plans, controlling models, role and responsibility matrices)
• Development of program-wide knowledge management using Confluence, creation of Jira concept
• Development of an access concept for all project tools
• Analyzing existing processes, identifying improvement potential, and designing solutions to increase efficiency and effectiveness
• Development of a concept for introducing automation approaches in existing tools
• Creating intranet articles as project marketing
• Responsible for project governance through reporting and resource planning in the sub-program
• Agile further development of the project method
• Gathering customer requirements (requirements engineering)
• Preparation and support of contract negotiations (7-year term, budget of over 500 million)

Participation in the EU-funded MORANE-2 project to validate the Future Railway Mobile Communication System (FRMCS) in real-life use cases: creation of the requirement specifications for TOBA as well as the associated test specifications.

Technologies: 5GS (Radio & Core), FRMCS, MCx (MCPTT, MCData, MCVideo), MC Gateway UE, MCx Priority/Security/QoS Management, ETCS, SIP, IMS

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Conceptual design and implementation of modular AI assistants for sales and business processes in the Microsoft ecosystem (Agentic AI, Copilot extensions)
• Frontend architecture and development with React + TypeScript for embedded chat and assistant surfaces (streaming UI, hooks, React Query, OpenAPI clients)
• Enterprise-level agent development: reusable skill/agent library, MCP server, review and compliance gates
• LLM integration into the user experience: Anthropic (Claude), OpenAI, tool use, RAG pipelines, prompt engineering, guardrails
• Architecture and code review consulting as well as mentoring in the AI development team
• Integration with Microsoft Graph, Power Platform, and Azure services
• Technologies: React, TypeScript, Anthropic Claude, OpenAI, MCP, RAG, Microsoft Graph, Power Platform, Azure

Independent, part-time open-source engineering focused on build-time tooling for Next.js, React, MDX, and JavaScript/TypeScript compiler pipelines.

• Built next-slug-splitter to optimize content-driven Next.js applications. It analyzes MDX content at build time, resolves component usage, and generates route-specific handlers so pages avoid sharing the full catch-all component bundle.

• Created supporting plugins and utilities for scoped MDX transformations, nested component dependency resolution, compile-time refinement, safe ESTree evaluation, and object-graph diffing.

• Own architecture, API design, implementation, automated testing, npm publishing, documentation, demos, and performance benchmarking.

Building blocks:

• remark-scoped-mdx: Context-aware AST transformations with nested scope isolation, typed component registries, and prop inference.

• recma-component-resolver: Dependency-graph analysis and selective component forwarding across nested MDX includes.

• recma-static-refiner: Build-time prop extraction, schema validation, derivation, and pruning.

• estree-util-to-static-value and object-graph-delta: Safe static evaluation and deterministic, cycle-safe structural diffing.

Tech Stack:

• Frameworks: TypeScript · Next.js · React · MDX

• Compiler tooling: Unified · Remark · Recma · MDAST · ESTree · ts-morph · esbuild

• Competencies: Static analysis · AST traversal and transformation · dependency graphs · code generation · schema validation · route and bundle splitting

• Tooling: Vitest · tsup · npm · performance benchmarking

• Processing and coordination of IT tickets (Helix, Omnitracker) incl. VIP support and remote support (Microsoft Teams, RDP, FastViewer)
• Onsite support at the main location as well as support for modern conference and meeting room technology (e.g. MeetingBoard 75 Pro)
• User and rights management in Active Directory (Active Roles), Azure AD, Exchange and MDM
• VDI support and monitoring with Citrix Director and Aruba Networking
• Endpoint management and policy administration via Ivanti
• Deployment, configuration and lifecycle management of clients (Dell notebooks, iPhones, iPads)
• Hardware rollouts for new employees incl. shipping across Germany
• Asset and license management as well as organization of site migrations

• Analysis of requirements and the current situation
• Migration of an old domain structure and Tobit to Exchange 2019 with integration to MS365
• Evaluation of implementation paths and planning for securing sensitive data
• Planning regarding BSI basic protection, the German Federal Data Protection Act (BDSG), and GDPR
• IT governance and IT security backtests
• Support with ERP setup and securing mail transfer
• Hyper-V 2016/2022, Microsoft Terminal Services Cluster, Microsoft Exchange 2019
• Office 365, Microsoft 365, Azure AD, Teams, Salesforce
• Cisco, Zyxel, and HP switches, Sophos firewalls/UTMs, SecurePoint
• Microsoft IIS 2022, IPv4/IPv6, Veeam, Wortmann online backup, NextCloud
• Services: DNS, DHCP, TCP/IP, subnetting, firewalling, routing, VoIP, Group Policy (GPO), SIEM, remote work, home office, high availability, failover, VLAN, PRTG

• Overall responsibility for the project lifecycle from scope definition to completion
• Close collaboration with platform teams, IT leaders, and external service providers
• Application of SAFe principles and structured sprint work
• Creation of a migration roadmap with clear milestones
• Monitoring of the lifecycle: onboarding, repository migration, replication of permissions, and system tests
• Visualization of the architecture with PlantUML and Gliffy as well as documentation in Confluence
• Regular status reports and running knowledge transfer sessions

In my role as Senior Cloud DevOps Architect for BP, an oil and gas company, I had the mission to migrate the Electric Vehicle Charging platform of the EV Division from on-premises and Azure to AWS cloud, resulting in a hybrid multi-cloud, multi-tenant SaaS solution.

Deployment with Kubernetes for the application layer meant provisioning Kubernetes clusters managed by EKS and AKS, with a focus on integrating them into a multi-tenant environment. This integration was achieved by using Kubernetes namespaces and access controls to ensure data isolation and privacy enforcement.

In the database layer, we chose an RDS instance with PostgreSQL to support the backend infrastructure of our applications. Tenants shared the same RDS instance, but each had a dedicated schema.

To ingest near real-time data from physical charge points (CPOs), as IoT devices, via the OCPI protocol, we ran into significant delays with batch processing. As a result, we built a real-time streaming data pipeline using Apache Kafka, while prioritizing an event-driven architecture.

Led collaboration across multiple internal teams, external vendors, cloud providers, and on-site partners to integrate over five systems into a unified solution.

Achievements:

• Successfully designed and implemented hybrid multi-cloud solutions, integrating multiple cloud platforms (AWS, Azure) with on-premises infrastructure, using Site-to-Site VPNs, Firewalls, and Load Balancing.
• Led the migration of on-premises infrastructure to multi-cloud, multi-tenant infrastructure, resulting in 30% faster processing times.
• Migrated workloads from VMware and Hyper-V environments to cloud-based VMs, leveraging cloud-native services to optimize performance, cost efficiency, and scalability.
• Designed a multi-tenant Kubernetes platform leveraging the Kubernetes ecosystem, using Karpenter for dynamic EC2 node provisioning, KEDA for event-driven pod autoscaling (e.g., Kafka message lag), and Rancher for centralized monitoring of multiple clusters (EKS, AKS, or on-prem K8s), replacing Microsoft-centric Azure Arc management service.
• Designed and implemented Python-based FastAPI microservices as part of the EV core-backend on AWS EKS application layer, powering data ingestion and customer analytics pipelines.
• Developed asynchronous, event-driven APIs (Python-FastAPI) for real-time integration with CPOs, supporting OCPI 2.3 and OICP protocols.
• Designed and implemented a secure, production-grade Azure Databricks platform using Terraform, ensuring scalability and cost efficiency.
• Migrated on-premises ERP to a hybrid Dynamics 365 architecture with ERP hosted locally and CRM running in Azure, integrated via Azure Arc.
• Automated CI/CD pipelines for Databricks notebooks and jobs using GitHub Actions & Databricks CLI, reducing deployment time. Reduced infrastructure provisioning time by 70% by automating cloud resource deployment with GitOps.
• Ensured compliance with internal audit and data governance standards (GDPR) through OAuth2/OIDC-based authentication and fine-grained role-based access controls.
• Developed a Zero Trust security model, enforcing least-privilege access and microsegmentation, enhancing security posture and compliance with GDPR and NIST.
• Built interactive analytics dashboards in Amazon QuickSight, integrating data from S3 and Redshift to deliver real-time business insights and visualizations with embedded access for multi-tenant users.
• Led cloud security assessments and full-lifecycle cybersecurity integration during M&A, covering AWS, Azure, IAM (Entra ID), and data protection, while aligning security posture with NIST, ISO 27001, and GDPR across hybrid and cloud-native environments.
• Reduced cloud costs by 64% for a client's dev environment by implementing automated start/stop schedules for EC2 and RDS instances via AWS CDK with EventBridge Scheduler or AWS Systems Manager.

Tech stack:

• Infrastructure as Code: Terraform, AWS CDK, Ansible.
• Containers: Kubernetes on EKS, AKS, Docker.
• Streaming Data Processing: Kafka to Confluent Cloud, after AWS MSK.
• Frontend: TypeScript, React, NextJS, Hooks, Styled Components.
• Backend: Python with FastAPI, also Node.js with NestJS.
• Database: Aurora on PostgreSQL with TypeORM, RDS on SQL Server, Azure Databricks full setup and administration, ETL Pipelines.
• CI/CD and GitOps: GitHub Actions, Azure DevOps, ArgoCD.
• Monitoring and Observability: Prometheus and Grafana.
• Virtualization: Hyper-V, VMware Cloud on AWS, Azure Migrate.
• ERP Systems: Odoo, Microsoft Dynamics 365 Business Central on Azure, integrated with Azure Arc.
• Networking: Site-to-Site VPNs, AWS Direct Connect, Azure ExpressRoute, Firewalls (AWS Network Firewall, Azure Firewall).
• Security: IAM, NIST Framework, Zero Trust Security, AWS WAF, AWS Shield, GuardDuty.

• As-is assessment of the current network infrastructure and its documentation, including on-site inspections
• Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
• Planning of new copper and fiber optic cabling, including patch panels
• Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
• Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
• Additional support after the components go live (hypercare phase)
• Regular communication with project management and client stakeholders

• PRISMA project
• Ansible automation
• Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019

Consumer Cards Solution Architect

• Provided architectural leadership in Consumer Cards Domain establishing best practices and improving architectural transparency and maintainability by designing a structured documentation framework to enable reverse engineering of legacy card systems.
• Standardized architectural artefacts including BIAN Business Capabilities, UML diagrams in draw.io format (Use Case, Component, Sequence), naming conventions, document repository, design templates and blueprints, microservices.
• Produced high-level and low-level designs aligned with enterprise architecture governance processes and artefact standards.
• Provided architectural support to the Strategic Card Simplification Programme, focusing on card product migrations and application decommissioning across all countries. Agile environments (Scrum/SAFe).
• Analysed and designed AI use cases in the architecture domain.

Project: Payment Card Industry Data Security Standards (PCI DSS) Strategic Programme

• Analysed and documented existing data flows across card products and geographic regions to assess PCI DSS compliance.
• Identified areas involving sensitive data at rest and data in motion requiring encryption or masking, ensuring adherence to PCI DSS requirements.
• Collaborated with security, infrastructure, and application teams to align encryption strategies with regulatory and organizational policies.
• Provided strategic advisory services on data strategy, data governance, data management, data quality, data architecture, data mesh, MEGA HOPEX, DAMA-DMBOK, event-driven architecture, end-to-end data flows and card product harmonization models.
• Ensured solution design alignment with regulatory compliance (BCBS 239, DORA, GDPR) and internal policies.

Project: Denmark ATM Outsourcing Project

Objective: Outsource ATM operations and maintenance to a third-party provider while expanding the Denmark ATM fleet, with Nordea retaining ownership of ATMs and cash for the existing and extended infrastructure.

• Led a cross-functional delivery team (project management, business analysis, and architecture) and documented the as-is ATM ecosystem architecture, including end-to-end data flows, integrations, and internal/external application interfaces.
• Designed end-to-end processes for authorization, reconciliation, and settlement, aligning operating model, controls, and compliance requirements across Nordea and the outsourced service provider.
• Produced high-level and low-level solution designs using standardized UML artefacts (Use Case, Component, and Sequence diagrams) to support vendor onboarding, integration planning, and implementation.
• Ensured architectural alignment and decision-making across enterprise stakeholders and third-party providers, managing dependencies and interfaces in the context of the outsourcing initiative.