FinOps Experts in Germany

Cloud Journey Kickoff on STACKIT

• Helped the client kickstart their cloud journey on sovereign EU STACKIT platform.
• Bootstrapped IAC & GitOps architecture with Opentofu and ArgoCD.
• Setup platform fundamentals for a fresh, holistic cloud experience: Kubernetes, external secrets, certificate management, gateway API, DNS & routing, observability basics.

• Short description: Lead a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations control while preserving the autonomy of decentralized business units within regulatory boundaries.

• Tasks and activities:

• Overall responsibility for the design, setup, and implementation of an enterprise-wide cloud governance structure (Azure), incl. target picture, roadmap, and operating model.

• Management of internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps) incl. decision-making and escalation management.

• Planning and facilitation of workshops on cloud strategy, governance principles, and the design of areas such as Identity, Connectivity, and Platform Management.

• Definition, implementation, and rollout of cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).

• Building a cloud governance framework aligned with the Azure Cloud Adoption Framework (CAF), incl. landing zone and guardrail concepts.

• Introduction of automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).

• Implementation of cloud security and compliance monitoring mechanisms as well as continuous improvement processes.

• Establishment and operationalization of FinOps in an enterprise environment (central and decentralized FinOps teams), incl. cost management strategies, reporting, and guardrails.

• Integration of governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).

• Implementation of access concepts incl. RBAC design and "break glass" mechanisms (emergency access) as well as certificate automation (ACME / step-ca).

• Achievements:

• Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud usage in a regulated environment.

• Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.

• Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).

• Significantly increased workload compliance for lift-and-shift migrations.

• Technologies used:

• Microsoft Azure Policy, custom policies.

• Terraform, OpenTofu, Terragrunt.

• step-ca (ACME).

• Entra ID.

• Azure Firewall.

• Azure networking, hub-and-spoke architecture.

• Azure vWAN (evaluation).

• Azure Front Door, Azure Application Gateway.

• Azure ExpressRoute.

• Azure Key Vault.

• NetBox.

• GitLab (on-premises).

• Infrastructure, concepts used:

• Cloud shared responsibility model.

• Hub-and-spoke connectivity / central shared services (from a hub-spoke context).

• Central governance with decentralized delivery (business unit autonomy with guardrails).

• Methods used:

• Scrum.

• Stakeholder management (C-level to engineering).

• Cloud governance, Azure Cloud Adoption Framework (CAF).

• DevOps, CI/CD.

• Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.

• RBAC, "break glass" concepts.

• ACME / certificate automation.

• GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.

• Built and further developed an AWS landing zone based on Terraform / OpenTofu (multi-account structure, IAM baselines, network and security standards)
• Designed and operated platform-oriented AWS architectures to standardize infrastructure and operations processes
• Built and operated Kubernetes-based platforms (EKS) as a shared runtime environment for application teams
• Established GitOps-based deployments with Argo CD and FluxCD
• Developed and operated central CI/CD platforms (GitLab CI, GitHub Actions, Jenkins)
• Enabled development and project teams through reusable platform building blocks
• Introduced and implemented FinOps structures (AWS Cost Explorer, CUR + Athena, Infracost, Grafana dashboards)
• Built and operated central observability platforms (Prometheus, Grafana, Loki, Alertmanager, CloudWatch)

• Member of the leadership team, 40 people across several international sites.

• Technical ownership of the shareholder's buy-and-build strategy: assessment of target companies and their subsequent integration.

• Platform, cloud infrastructure, information security and the engineering organisation.

• Azure Landing Zone architecture: Design and implement a hub-spoke, multi-region-capable Azure landing zone that provides the secure, scalable and highly available foundation for autonomous driving and parking data/ML platforms.
• Compliance through Azure Policy: Enforce security and compliance standards across Azure subscriptions via Azure Policy (guardrails, deny/audit/deploy-if-not-exists), consistently achieving top-tier infrastructure security scores.
• Infrastructure-as-Code: Automate provisioning and configuration of Azure resources with Terraform and Bicep, with changes delivered through reviewed CI/CD pipelines.
• Azure Databricks and Unity Catalog: Extensive experience operating Azure Databricks with Unity Catalog for centralized data governance, access control, lineage and auditing across workspaces.
• Monitoring and observability: Built and run infrastructure monitoring and logging with Azure Monitor, Prometheus, Grafana and Loki, covering platform health, alerting, troubleshooting and capacity trends.
• Platform at scale: Architected and operate cloud data/ML platforms supporting multi-PB vehicle data ingestion and simulation; orchestrate Argo Workflow-based recompute and autolabeling services scaling to 100k+ concurrent pods on AKS.
• Reproducible ML: Established reproducible training environments with dataset versioning and provenance tracking, enabling auditing and experiment reliability.
• Operational excellence: Automated GitHub organization management and CI/CD pipelines, improving developer productivity and deployment reliability; automated recurring operational processes.
• FinOps: Developed transparent resource utilization and cost-tracking for multi-project Azure environments.
• Leadership: Technical lead for infrastructure topics, collaborating with development, DevOps and security teams; technical interviewer and recruitment panel member for scaling the engineering team.

In my role as Senior Cloud DevOps Architect for BP, an oil and gas company, I had the mission to migrate the Electric Vehicle Charging platform of the EV Division from on-premises and Azure to AWS cloud, resulting in a hybrid multi-cloud, multi-tenant SaaS solution.

Deployment with Kubernetes for the application layer meant provisioning Kubernetes clusters managed by EKS and AKS, with a focus on integrating them into a multi-tenant environment. This integration was achieved by using Kubernetes namespaces and access controls to ensure data isolation and privacy enforcement.

In the database layer, we chose an RDS instance with PostgreSQL to support the backend infrastructure of our applications. Tenants shared the same RDS instance, but each had a dedicated schema.

To ingest near real-time data from physical charge points (CPOs), as IoT devices, via the OCPI protocol, we ran into significant delays with batch processing. As a result, we built a real-time streaming data pipeline using Apache Kafka, while prioritizing an event-driven architecture.

Led collaboration across multiple internal teams, external vendors, cloud providers, and on-site partners to integrate over five systems into a unified solution.

Achievements:

• Successfully designed and implemented hybrid multi-cloud solutions, integrating multiple cloud platforms (AWS, Azure) with on-premises infrastructure, using Site-to-Site VPNs, Firewalls, and Load Balancing.
• Led the migration of on-premises infrastructure to multi-cloud, multi-tenant infrastructure, resulting in 30% faster processing times.
• Migrated workloads from VMware and Hyper-V environments to cloud-based VMs, leveraging cloud-native services to optimize performance, cost efficiency, and scalability.
• Designed a multi-tenant Kubernetes platform leveraging the Kubernetes ecosystem, using Karpenter for dynamic EC2 node provisioning, KEDA for event-driven pod autoscaling (e.g., Kafka message lag), and Rancher for centralized monitoring of multiple clusters (EKS, AKS, or on-prem K8s), replacing Microsoft-centric Azure Arc management service.
• Designed and implemented Python-based FastAPI microservices as part of the EV core-backend on AWS EKS application layer, powering data ingestion and customer analytics pipelines.
• Developed asynchronous, event-driven APIs (Python-FastAPI) for real-time integration with CPOs, supporting OCPI 2.3 and OICP protocols.
• Designed and implemented a secure, production-grade Azure Databricks platform using Terraform, ensuring scalability and cost efficiency.
• Migrated on-premises ERP to a hybrid Dynamics 365 architecture with ERP hosted locally and CRM running in Azure, integrated via Azure Arc.
• Automated CI/CD pipelines for Databricks notebooks and jobs using GitHub Actions & Databricks CLI, reducing deployment time. Reduced infrastructure provisioning time by 70% by automating cloud resource deployment with GitOps.
• Ensured compliance with internal audit and data governance standards (GDPR) through OAuth2/OIDC-based authentication and fine-grained role-based access controls.
• Developed a Zero Trust security model, enforcing least-privilege access and microsegmentation, enhancing security posture and compliance with GDPR and NIST.
• Built interactive analytics dashboards in Amazon QuickSight, integrating data from S3 and Redshift to deliver real-time business insights and visualizations with embedded access for multi-tenant users.
• Led cloud security assessments and full-lifecycle cybersecurity integration during M&A, covering AWS, Azure, IAM (Entra ID), and data protection, while aligning security posture with NIST, ISO 27001, and GDPR across hybrid and cloud-native environments.
• Reduced cloud costs by 64% for a client's dev environment by implementing automated start/stop schedules for EC2 and RDS instances via AWS CDK with EventBridge Scheduler or AWS Systems Manager.

Tech stack:

• Infrastructure as Code: Terraform, AWS CDK, Ansible.
• Containers: Kubernetes on EKS, AKS, Docker.
• Streaming Data Processing: Kafka to Confluent Cloud, after AWS MSK.
• Frontend: TypeScript, React, NextJS, Hooks, Styled Components.
• Backend: Python with FastAPI, also Node.js with NestJS.
• Database: Aurora on PostgreSQL with TypeORM, RDS on SQL Server, Azure Databricks full setup and administration, ETL Pipelines.
• CI/CD and GitOps: GitHub Actions, Azure DevOps, ArgoCD.
• Monitoring and Observability: Prometheus and Grafana.
• Virtualization: Hyper-V, VMware Cloud on AWS, Azure Migrate.
• ERP Systems: Odoo, Microsoft Dynamics 365 Business Central on Azure, integrated with Azure Arc.
• Networking: Site-to-Site VPNs, AWS Direct Connect, Azure ExpressRoute, Firewalls (AWS Network Firewall, Azure Firewall).
• Security: IAM, NIST Framework, Zero Trust Security, AWS WAF, AWS Shield, GuardDuty.

• Lead Presales, R&D, Product, and Engineering for EMEA region – remote/hybrid, multicultural teams of 30+
• Serve as Information Security Officer (ISO), leading ISO 27001 certification efforts and conducting regular security audits
• Implement and maintain comprehensive information security management systems (ISMS) ensuring compliance with GDPR, DORA, and international regulations
• Architect data intelligence, SaaS, and unstructured data solutions using AI, ML, and cloud-native tech
• Drive solution sales initiatives, conduct technical demonstrations and engage with enterprise customers to deliver tailored solutions
• Engaged in hands-on pilots with cutting-edge cloud platforms, Generative AI, and edge computing
• Represent company in major industry forums – regular interface with C-level, customers, and partners
• Delivered proven 35-45% cost/complexity reduction with innovative, automated compliance and privacy frameworks.

• Lead a cross-functional squad of backend, frontend, and ML/data engineers, balancing hands-on contribution (architecture, coding, reviews) with team leadership (mentoring, backlog prioritization, roadmap alignment).
• Designed and delivered ML-powered search and discovery features, including Learning-to-Rank (LTR), query expansion, and vector search, improving result relevance and user engagement.
• Implemented personalization and recommendation pipelines, using behavioral data and segmentation to increase customer retention and lifetime value.
• Established data-driven practices, building A/B testing and experimentation workflows (Odyn, MLflow) to measure feature impact on CTR, NDCG, and conversion.
• Owned the squad’s architecture and delivery roadmap, modernizing services with cloud-native microservices and event-driven systems (AWS, Pulumi, Terraform) to improve scalability and reliability.
• Improved reliability and operational excellence, introducing observability (Prometheus, Grafana, NewRelic), incident management, and postmortems that reduced downtime for customer-facing services.
• Mentored and supported engineers, fostering technical growth, collaboration, and a customer-first mindset through regular feedback, coaching, and code reviews.
• Worked closely with product managers, researchers, and business stakeholders to translate customer insights into technical solutions that improved discovery, engagement, and retention.
• Explored Generative AI/LLM use cases (GPT-4, LangChain, RAG), prototyping intelligent assistants and personalized discovery workflows that increased user satisfaction.
• Delivered tangible results: boosted engagement through personalization, contributed to revenue uplift, and reduced incidents by embedding resilience and observability.

• Building an independent enterprise IT setup — cloud strategy, network, AWS landing zone, security requirements, contract negotiations.
• Migration of all applications; avoiding high contractual penalties for the client.
• Onboarding and coordination o...

• Responsible for development, architecture, QA, BI, AI and cloud operations across a global engineering organization of 150+ engineers in 21 teams across 6 countries
• Led the transformation from legacy single-tenant architecture to a cloud-native multi-tenant SaaS platform using AWS, Kubernetes and event-driven architectures
• Established engineering operating models, architecture governance and DevOps practices across multiple international teams
• Introduced Generative AI capabilities (Azure OpenAI, RAG) to enable AI-driven product features and secure enterprise data access
• Responsible for cloud infrastructure strategy, security and compliance (ISO 27001, SOC1/2) and cloud cost optimization (FinOps)
• Led enterprise integrations with ERP, CRM and commerce systems for global customers

• Sole Managing Director and head of my own company, consulting for corporate clients and start-ups.

• Built a global IT platform for a large logistics company to operate local IT infrastructure (applications not cloud-ready).

• FinOps project for the multi-cloud landscape of a large logistics company to significantly reduce cloud costs.

• Preparation for the cloud migration (AWS) for a medium-sized provider of aftermarket data in the automotive sector.

• Cloud migration preparation (AWS) for a medium-sized company (book wholesale).

• Cloud migration preparation and migration for an insurance company (database technology change - Kubernetes cluster).

• Cloud vs. on-premises evaluation project for an insurance company (database technology change – Kubernetes cluster).

• Built, led, and directed a global team of 350+ FTE across Luxembourg, Germany, Poland, Romania, Tunisia, Philippines, and India to drive delivery and transformation through smart solutions and platforms.
• Managed a product/platform portfolio exceeding €25M, linking investment to measurable outcomes.
• Delivered two client-facing platforms: FMSP Financial Managed Services Platform (30+ products for Tax and Consulting) and Fund Audit Platform (Genesis).
• Launched an internal digital platform (employee facing) with 15+ tools for internal functions Finance, HR, and QRM.
• Established and executed the AI strategy (data extraction, generation, exploration) to unlock productivity and create new data driven solutions and opportunities.
• Deployed M365 Copilot, GitHub Copilot, and Copilot Agents locally in Luxembourg to more than 40% of the EY Luxembourg users.
• Led the migration of EY Luxembourg from on-prem to Microsoft Azure cloud, improving scalability, resilience, and security.
• Instituted a product-centric operating model (OKRs, portfolio & demand management, release governance) and delivery standards (DevSecOps, SRE, QA automation) with InfoSec metrics.

• Operational license management: reviewing and approving software requests, license consulting, and legally compliant procurement of licenses
• Managing global vendor portals (Broadcom, Adobe, Autodesk, Corel) and ensuring data validity in the USU LiMa SAM tool as part of a carve-in
• Creating cross-vendor compliance reports
• Identifying and resolving compliance and IT security risks in the server landscape using USU LiMa

• Developed automated ETL pipelines with AWS Glue and Athena to ensure consistent data quality and governance requirements
• Implemented validation, anonymization, and encryption measures for data in compliance with GDPR
• Optimized cloud costs by introducing FinOps practices and increased transparency for business units
• Monitored performance, performed root cause analyses, and ensured adherence to SLAs
• Supported data and solution architects in building scalable data models for ML and analytics scenarios