Fortify Experts in Germany

Project: SCS (Settlement / Clearing Services)

Settlement platform serving multiple trading and clearing venues — counterparty risk safeguarding, settlement volume reduction, central risk management, and post-trade anonymity.

Technologies: Java 17, Spring Boot 3, Microservices, Spring Data JPA, SonarQube, Fortify (SCST), Mockito, Jenkins, OpenShift, Maven, Podman, GitHub, JIRA, Liquibase, Swagger, AMQP, Apache Camel, Terraform, PostgreSQL, Instana, Graylog.

• Identified and remediated CVEs in third-party libraries using SCA tooling, strengthening the security posture of production components.
• Maintained 90% code coverage with SonarQube, improving code quality and reducing production defects.
• Built and customized Helm charts and values.yaml configurations across 3 environments (ACT, SIMU, PROD), increasing deployment flexibility and consistency.
• Enabled mTLS for database authentication and message broker connections, enforcing encrypted, certificate-validated communication.
• Designed and deployed microservices with asynchronous, REST-based communication between components.
• Automated build and continuous integration pipelines using Maven and Jenkins.
• Used Podman and OpenShift for container orchestration and Liquibase for database version control.
• Optimized Java code and implemented EHCache-based caching, improving application performance.
• Managed application images, JAR versions, and dependencies via DBAG Artifactory Repository Manager.

• Implementation of specified DevOps solutions to automate infrastructure (Terraform, Bicep, CloudFormation, Ansible) on-premises datacenter (Ovirt, Proxmox, Ceph Cluster, MinIO) and private cloud.
• Administration, configuration and implementation of CI/CD DevOps pipelines (GitLab, GitFlow) to support development process (Artifactory, Prometheus, Istio, service mesh, Helm Chart, OpenShift (Red Hat Enterprise) / Kubernetes cluster), Red Hat Satellite.
• Administration, setup, monitoring and patching of Linux infrastructure based on Red Hat Enterprise for Dev, Test and QA.
• Use of Scrum and Kanban methods.
• Administration, configuration and implementation of security standards for deploying on Dev, Test, QA and Prod stages of the new ePA applications.
• Development of new plugins and add-ons needed on current infrastructure.
• Database support.
• Data analytics support (Python, Spark, Pandas, Power BI, Splunk Enterprise).
• Implementation of best practices for DevSecOps and BizDevOps using GitOps (ArgoCD), Streamlit framework, Semaphore Ansible UI.
• Configuration and testing of iperf, uperf, sysbench using benchmark-operator for external source data and IoT/MDM devices, creating reports via ELK / OpenSearch.
• Building a new Databricks platform to collect and analyze big data from different sources and IoT devices into Hadoop framework (Python, Pandas, PySpark, Power BI, Apache Airflow).
• Building backend data aggregation and processing to automate configuration deployment between different OpenShift clusters and big data framework (Python, Pandas, PySpark, Apache Spark, PostgreSQL, Django 2, Ansible Automation, Jira JSM).
• Building a new ML pipeline platform using Kubeflow, TensorFlow, KServe.
• Data extraction, transformation and loading from different data sources including structured and unstructured data to analytic DWH / big data cluster using Python, Pandas, Polars, Power BI, Django backend and PostgreSQL.
• Setup of new DevOps Test and QA HashiCorp Vault cluster for PKI and IAM.
• Configuration and testing of automated patching based on CVSS score, SIEM-integrated CVEs.
• Use of Nexpose and InsightVM to scan vulnerability events in network, host, container and application.
• Design and implementation of secure and scalable AWS architectures including VPC, EC2, S3, RDS and Route53 and similar setups on Azure and GCP.
• Automated system provisioning and deployment using CloudFormation templates.
• Configuration of IAM roles, policies and permissions to ensure secure access control.
• Patch management, backup automation and disaster recovery setup on AWS infrastructure.
• Monitoring and optimization of system performance using AWS CloudWatch and AWS Trusted Advisor.
• Support of VMware services (vSphere, Aria, Horizon) and the virtual desktop environment.
• Development and maintenance of CI/CD pipelines using Jenkins, GitLab CI/CD and AWS CodePipeline with interface to Nutanix.
• Configuration of AWS CloudWatch to monitor application performance and system events.
• Planning and execution of migration of on-premises applications to AWS cloud platforms.
• Deployment of containerized applications using Docker and Kubernetes in AWS environments.
• Deployment of internal software packages between availability zones using AWS CodeDeploy.
• Building and deploying ML models using Scikit-learn, XGBoost and Spark MLlib including hyperparameter tuning, model evaluation and production deployment.

• Devised a new Domain-Driven Design architecture for a core system: reverse-engineered a central component, refactored the data-access layer to minimise database round-trips (improving scalability) and migrated processing to async.
• Decomposed the platform into independent .NET Core microservices (database-per-service) with RabbitMQ pub/sub using the Outbox Pattern + Saga choreography, behind an Ocelot API Gateway (JWT, rate limiting, CORS, health checks).
• Delivered on .NET Core / Angular / SQL Server / EF Core with Docker and Azure DevOps CI/CD; implemented health checks and CORS; contributes technical designs for stories in agile Scrum.
• Sole ADR owner; mentored 3 engineers and presented architecture decisions directly to the Director of Corporate IT.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Network elements, network, operational and operator-related systems
• Supporting around 20 different products (managed agile)
• Requirements analysis and management (functional and non-functional)
• Test concept and planning (scope, test phases, effort, schedule, resources, organization, etc.)
• Aligning approach with clients and service providers
• Managing and assisting in creation of test cases for system, integration and end-to-end tests
• Guiding and supporting test execution
• Defect management and planning bug fixes with external providers
• Preparing and facilitating workshops
• Regular reporting and creating automated test reports
• Further development of agile testing methodology and configuration of supporting tools
• Conceptual support in developing a quality seal for rating product and service quality of internal and external providers
• Requirements engineering based on ISO/IEC 25010, Scrum, SaFE
• BMC Remedy, Atlassian Confluence, Atlassian Jira (including plugins Xray, Structure), Microsoft Office (incl. Visio), Obsidian, doxis document management system, Gitlab, Obsidian

• Requirements analysis for the enterprise-wide observability platform.
• Creation of playbooks and pipelines for rolling out Envoy, OpenTelemetry Collectors, and OpenTelemetry Agents.
• Conducting load tests for capacity planning of metrics for the observability platform.
• Documentation and implementation of compliance standards for production readiness.
• Creation and design of RED metrics, spanmetrics, JBoss, and Tomcat dashboards for mission-critical applications.
• Setting up alerts for critical applications for proactive incident response.
• Integration of OpenShift applications into the enterprise-wide observability stack.

• Third communications team hire; built and led Instacart’s first Brand Communications and Social Impact functions.
• Tapped to additionally lead Brand/Consumer Communications and Product/Technology Communications.
• Directed the launch of Instacart Health, resulting in more than 100 pieces of media owned content coverage across business, technology, health, policy, consumer and grocery industry media, making the launch Instacart’s #1 proactive media cycle of 2022.
• Led the launches of Instacart’s first integrated brand campaigns, including “The World is Your Cart” featuring Grammy Award–winning artist Lizzo, resulting in top-tier national coverage across mainstream consumer, business, ad/marketing trades and tech outlets.
• Oversaw the successful launch of Instacart’s first Developer Platform, which included top-tier partners including The New York Times and WeightWatchers.
• Built Instacart’s first data storytelling program, including hiring a data analyst and developing an internal Trends Expert spokesperson, resulting in an always-on storytelling machine that drives thousands of pieces of coverage and established Instacart as a top source of grocery insights (e.g., led an opportunistic news cycle on “egg-flation” using Instacart data insights, resulting in hundreds of pieces of coverage).
• Established Instacart’s first celebrity partnerships, resulting in branded social media posts and Instacart endorsements in top consumer and lifestyle outlets.
• Led the development of Instacart’s first social impact strategy in service of the company’s policy objectives, including a three-year, multi-million-dollar partnership with Partnership for a Healthier America, a disaster relief program with Feeding America, and an employee volunteering and donation matching program.
• Created and led “Get Vaxxed for Snacks,” a pandemic-era vaccination campaign that resulted in 100+ pieces of media coverage and bolstered the company’s policy relationships.
• Conceived and directed Instacart’s first Giving Tuesday holiday giving campaign, leading to strong press coverage and an annual strategy that grew to include brand advertising partners.

• Further development of framework components and services in the Enterprise Banking Control Platform (EGP Framework), a set of cross-cutting libraries and services for all bounded context scopes of the platform.
• Migration from Java 17 to Java 21 and from Spring Boot 3.2 to 3.4 in about 80 library and service repositories (updating Maven POMs, Dockerfiles, Jenkins pipelines, source code migration, test updates).
• Writing unit and integration tests with JUnit and JGiven.
• Performing and analyzing performance measurements with Dynatrace.
• Enhancing multi-stage CI/CD pipelines (unit tests, security analyses, Docker builds, Harbor deployments, ...).
• Tech stack used: Java (90%), Python (10%), Spring Boot, JPA/Hibernate, JGiven, OpenAPI, Camunda 7, Podman, OpenShift/Kubernetes, Oracle DB, SonarQube, Dynatrace, Jenkins, Harbor, Bitbucket, Jira, Confluence.

• Develop hardware drivers and middleware using C++11, Java and Python
• Design of various RF features such as deembedding based on stakeholder requests
• Work with multiple teams to design drivers for multiple RF products
• Perform HW control to deliver RF signals and measure modulated response
• Develop RF drivers for generation of low noise signals to test WiFi7 products
• Use digital modulation techniques such as QAM for low level driver development
• Develop low level USB drivers for device enumeration
• Develop drivers for HW relay control of control boards for device testing
• Perform JTAG operations on devices under test
• Use network-based protocols (SFTP, UFTP, FTP, SSH) for control board communication
• Manage HW devices such as BADC and EEPROM for control board maintenance
• Utilize C++11/14/17 features, template metaprogramming and STL
• Employ multithreading for testing and control of multiple HW devices
• Develop tools for deployment of customer OS on control boards
• Perform component and integration tests using CxxTest
• Follow Scaled Agile Framework for software development
• Create detailed design documents using PlantUML

• Established strategic business units, implemented Objectives and Key Results (ORKs), metrics and management systems, and defined career hierarchies. Led teams across product, program, design, and research domains to optimise organisational efficiency and innovation.

• Drove successful market entry for sophisticated digital twin solutions, overseeing a portfolio of DeepTech and SaaS products while seamlessly transitioning to a SaaS business model. Spearheaded competitive market positioning, sales, and distribution strategy within a complex landscape. Held the company’s core business leadership, catalysing a comprehensive organisation-wide restructure to fortify growth.

• Facilitated data retrieval for first-assist applications through an interface that fetches content based on client input criteria and loads it into the database via batch processing.

• Head of technical overall integration NSC (National Secure Cloud project with about 60 employees).

• Technical integration of all subprojects into one product, definition of interfaces, basic components of a cloud including hardware, technical architecture of the IABG base.

• Development of a Cloud Management Platform (CMP) that can create a private/mixed cloud of any complexity based on a textual description with one click or interactively.

• CMP also includes the complete hardware management cycle.

• As a foundation, it uses Kubernetes, OpenStack, and Hadoop.

• The management layer includes Harbor, Gitea, Longhorn, Keycloak, Rancher and Jenkins, which are automatically configured.

• The private cloud can run any customer workloads, including a full Hadoop stack with HDFS, Spark, MapReduce, Mesos, HBase and around 20 other ML/DL technologies.

• Hadoop worker clusters can also be automatically installed on bare metal or commodity hardware without Kubernetes.

• OpenStack with Nova, Neutron, Ironic, Swift, Cinder, Ceph.

• Development of a Java application Rudi: SOAP, REST, containers, database.

• Technologies: Kubernetes (K3s, RKE2, Minikube, Harbor, Gitea, Jenkins, Longhorn, Keycloak, Rancher), OpenStack (Nova, Neutron, Keystone, Swift, Ceph, Cinder, Sahara, Magnum, Kayobe, Kolla, Bigrost, Ironic), Hadoop (HDFS, Ambari, Solr, Livy, Ranger, YARN, Tez, HBase, Kafka, Hive, Zookeeper, MapReduce, Spark, Oozie, Flink), virtualization (Kubernetes (K3s), VMware, Oracle), scripting (Ansible, Puppet, Juju, Shell, Groovy, Gradle, Maven).