Identity and Access Management Expert

• Patch management and system hardening for Linux and Windows via AWS Systems Manager, including Maintenance Windows; image pipelines (AWS Image Builder), Ansible, and PowerShell DSC
• IT security & compliance: IAM/KMS/MFA, secrets management, Policy-as-Code (Checkov, tfsec, cfn-nag), AWS Config, CloudTrail, and Security Hub; infrastructure security audits, internal audits, penetration tests, and incident response exercises
• Analysis of cloud security reports and implementation of preventive measures; automated security and compliance tests; backup strategies using snapshots and S3 Glacier
• Administration of multiple AWS accounts (VPCs) with up to 2.500 Linux and Windows servers and hybrid networks
• Automation using Terraform, OpenTofu, CloudFormation, Ansible, and PowerShell DSC; CI/CD with GitLab CI and GitHub Actions
• Planning of rollouts, upgrades, and lifecycle management for key components; coordination with DevOps, security, and development teams; preparation of concepts and decision papers

SIEM/SOC Wazuh Implementation

Logistics

Wazuh | OpenSearch | Use Cases | Dashboards | Training

• Advised and provided technical support for the implementation of Wazuh as a SIEM solution
• Prepared and coordinated with teams involved in firewall, network, and IT operations
• Installed and configured Wazuh on the designated server infrastructure
• Developed security-related use cases and dashboards for centralized monitoring
• Delivered employee training on using and analyzing data from the SIEM solution

System Transformation Audit

Supporting a project-related IT audit of a system transformation within the financial services sector, focusing on controls associated with different types of system migrations. The work involves reviewing migration-specific documentation and supporting evidence to assess whether the controls for each migration type are adequately evidenced and sufficient to address the associated migration risks. Particular emphasis is placed on the adequacy of control measures, the reliability of supporting evidence, and safeguards relating to data integrity and migration-related risks.

Team Size: 2 project managers, 1 delivery manager, 2 senior consultants

Tasks & Responsibilities:

• Reviewing documentation and supporting evidence for different types of system migrations.
• Assessing migration-specific control procedures and evaluating whether the controls are appropriate and sufficient to address the associated risks.
• Evaluating the adequacy and completeness of evidence provided to demonstrate that migration controls have been performed as intended.
• Reviewing relevant control measures designed to safeguard data completeness, accuracy, and integrity during migration, where applicable.
• Identifying potential control gaps, insufficient evidence, and areas requiring further clarification or additional audit procedures.
• Assessing whether the documented migration approach and associated controls adequately address the risks arising from the respective migration type.
• Coordinating with relevant project stakeholders to clarify migration procedures, obtain supporting documentation, and follow up on open audit questions.
• Documenting audit procedures, evidence reviewed, control assessments, and observations in accordance with the engagement's audit methodology.

Audit Standards, Methodologies and Regulatory Frameworks: Migration Controls Assessment, Migration Risk Assessment, Evidence Review, Control Testing, IT Audit Documentation.

Areas of Expertise: System Transformation, System Migration Controls, Migration Risk Assessment, Control Evaluation, Evidence Assessment.

Main Results & Achievements:

• Contributing to the assessment of migration controls and the identification of potential control gaps.
• Identifying evidence deficiencies and areas requiring further clarification.
• Documenting audit observations and supporting the evaluation of migration-related risks and control effectiveness.

• Automated Kubernetes deployments to over 400 customer target environments (Rancher/RKE2) using versioned Helm charts and Argo CD ApplicationSets for daily releases.
• Created self-service customer onboarding based on versioned runbooks, reducing the process from days to hours; coordinated with customer IT teams (AD/LDAP, SMB/DFS, network).
• Migrated selected services to AWS alongside the Open Telekom Cloud platform: provisioned VPC, EC2, and IAM roles with least-privilege policies using Terraform; operated workloads on EC2.
• Set up Keycloak realms and OIDC/SAML clients for product SSO, federated with customers’ Active Directory.
• Set up tenant-specific strongSwan IPsec sidecars on Kubernetes instead of a central transit VM, with keys in HashiCorp Vault: reduced connectivity costs by approximately 80%, with DFS indexing over the tunnel.
• Designed the high-availability migration of the Redis environment to managed OTC DCS; set up alerting and on-call rotations with incident.io by severity, and improved Grafana queries and indexing.

Migration from Microsoft Dynamics to a Multi-Cloud Salesforce Platform

• Lead of the Field Service stream in a programme replacing Microsoft Dynamics with Salesforce Sales, Service, Marketing and Field Service, including access for external contractors.
• Designed the end-to-end process from opportunity or case via work order and the Field Service mobile app to the service report.

• Manage multiple Kubernetes clusters in Production with Ceph as storage layer.
• Implemented CICD pipelines for automating deployments with Gitlab CI
• Terraform for Infrastructure provisioning.
• Claude code
• Helm charts for deploying via ArgoCD
• Implemented automated incident notification pipelines in Kubernetes to align with NIS2 mandatory 24-hour early warning disclosure rules
• Configured Azure Policy and Logging guardrails aligned with BSI IT-Grundschutz (SYS.1.3 / OPS.1.1), ensuring continuous baseline compliance across 50+ cloud workloads

Environment: Gitlab CI, IONOS Cloud, Ceph, ArgoCD, terraform, Elastic cluster, Grafana, Alert Manager & Prometheus

• Architected, Deployed and Supported hosted email solutions in Linux and Windows environments with enterprise-grade anti-spam and security architecture for service-provider environments.
• Managed Microsoft Azure environments including Virtual Machines, VNets, Storage, VPN, and Firewall configuration.
• Administered Microsoft Exchange Server (2010-2019), Microsoft Exchange Server SE, Active Directory, PKI, Hyper-V and Zimbra environments with disaster recovery planning and operational support.
• Led Microsoft 365 onboarding and migration projects from Exchange, IMAP, and Zimbra platforms to Microsoft 365.
• Prepare security and compliance to support Microsoft 365 Copilot.
• Implement information protection and data loss prevention by using Microsoft Purview.
• Implement retention, eDiscovery, and communication compliance in Microsoft Purview.
• Integrated Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and Active Directory Federation Services (AD FS).
• Delivered secure hybrid infrastructure solutions integrating Microsoft Windows Server and Linux-based enterprise environments.
• Supported enterprise integration projects involving Debian, Ubuntu, CentOS, Red Hat, Barracuda ESG, Qmail and Zimbra Platforms.

Red Hat OpenShift Container Platform

Scope:

• Operation and configuration of the Red Hat OpenShift Container Platform, including network, storage, and security design.
• Implementation of centralized observability solutions (Prometheus, Grafana, alerting).
• Development of CI/CD pipelines, GitOps workflows, and automation frameworks.
• Training and enablement of operations and development teams.

Result: Accelerated service delivery, transparent operational metrics, and sustainable knowledge transfer.

• Temporary cover for an absent non-financial risk officer.
• Operational scope: incident intake and follow-up, internal control testing, and first-line reporting for the Belgian entity.

• Create and lead roadmap forecasting of support opportunities, including colleague training, process design and improvement, and new hire onboarding.
• Collaborate seamlessly with cross-functional teams including Professional Services, Support, Product, Sales, and Solution Engineering.
• Manage business and financial KPIs in alignment with overall business objectives.
• Industrial IT & Data Integration: Implement, configure, and integrate OT/IT systems and data flows, connecting control-layer sources (DCS, PLC, SCADA) to historians, data platforms, and enterprise systems through APIs and standard interfaces.
• AVEVA PI & Historian: Configure, maintain, and extend AVEVA PI (PI Data Archive, Asset Framework, interfaces/connectors) to capture, contextualize, and serve real-time and historical operational data.
• Alarm Management: Support and optimize alarm management systems – e.g. Honeywell Alarm Management – including alarm rationalization, classification, and the analysis of alarm performance, critical alarms, and alarm floods.
• Connectivity & Protocols: Set up and troubleshoot industrial connectivity using OPC UA and OPC A&E, including the configuration of tunnelers / wrappers to bridge OT data sources securely and reliably.
• Production Data Flow: Ensure seamless, secure, and well-structured data flow across the industrial IT landscape, transforming raw operational data into meaningful information for operations and decision-making.
• System Support & Troubleshooting: Provide ongoing support for OT/IT applications, troubleshooting issues across networks, software, and data integrations to keep systems running efficiently.
• Knowledge Management & Best Practices: Contribute to internal documentation, best practices, and troubleshooting guides, and help continuously improve how we deliver industrial IT and data solutions.

Tools & Software: Aveva PI, Salesforce, Active Directory, Microsoft Dynamics 365, Jira, Microsoft, Scrum, DevOps, Docker, CI/CD, Jenkins, GitHub.

• Applied modern JavaScript features, including ES6+ syntax, destructuring, modules, array methods, and asynchronous programming, to develop efficient and readable frontend code.
• Implemented frontend integration patterns for PHP and Laravel backend services, connecting React interfaces to REST APIs and handling structured JSON data.
• Developed interactive, functional component-based frontend applications using React Hooks, JavaScript, and TypeScript, alongside backend applications and RESTful APIs using Python, Django, Flask, and FastAPI, focusing on reusable components, modular architecture, maintainability, and efficient data processing.
• Maintained a dynamic portfolio platform using PHP, Laravel, Livewire, and MySQL, implementing end-to-end functionality across frontend interfaces, backend services, and database operations.
• Validated server-side request handling, routing, middleware, and form validation using Laravel features to support reliable application workflows and consistent data processing.
• Designed and managed relational database structures using MySQL and Laravel Eloquent ORM, implementing data models, relationships, database migrations, and efficient queries for content management.
• AI-powered applications integrating Large Language Models (LLMs) through external APIs and locally hosted models, exploring practical use cases for conversational AI, intelligent automation, and AI-assisted workflows.
• Built local AI applications and developer tools for running, configuring, and interacting with locally hosted language models, gaining experience with local inference, model integration, and privacy-conscious AI workflows.
• Explored Retrieval-Augmented Generation (RAG) approaches to combine language models with external knowledge sources, enabling context-aware responses based on relevant application data and retrieved information.
• Integrated AI services with backend APIs and application components, developing reusable modules for model communication, response processing, error handling, and data exchange.

• Conducting information classification, risk management and supplier assessment workshops
• Introduction of a customer-specific information security minimum standard (based on TISAX and ISO 27001) since Apr. 2026; implementing the same standard in parallel for a second customer
• Building an ISMS according to ISO 27001 for a logistics company (approx. 160–200 MA)
• Municipal utility company (KRITIS, approx. 450 MA): independently introduced the CRISAM GRC tool and am currently expanding it to include NIS-2 areas, took over parts of the ISB support mandate, and followed up on and remediated audit findings
• Supporting customers in implementing DORA and NIS-2, including documentation for a financial institution
• Conducting and supporting audits of systems for attack detection (SzA) according to § 8a BSIG (today §§ 31, 39 BSIG)
• Creating network structure plans according to IT-SiKat
• Creating technical security concepts (logging, IAM, attack detection)

Interim Lead ITSM Transformation

Industry: Retail & Industry – Optics (partly critical infrastructure)

Mandate: Transition of ITSM governance to the product- and capability-oriented governance model already established across the Group, as well as acceleration and partial automation of service volumes through optimized entry channels. Design and system-based implementation of an ITSM target operating model.

• ITSM target process design based on the capability owner model: target processes and ownership for Incident, Service Request, Problem, Change Enablement, CMDB, Service Level, Supplier and Knowledge Management, derived from the Group-wide target operating model
• AI-supported Enterprise Service Management: Reorganization of currently mixed requests into a structured, cross-functional service model including a new self-service portal. AI-supported classification and automation considered in the architecture model
• Migration & Cloud Architecture: Planning and management of the end-to-end migration, coordination of cutover management and go-live support; ensuring productive stability during the hypercare phase. Consideration of a multi-source CMDB (~500,000 assets), connection of go-live-critical field service and vendor interfaces
• Scaling & Blueprint: Central instance for headquarters and production, designed as a blueprint for additional international retail and production sites
• Delivery and Stakeholder Management: End-to-end management from target vision to go-live with regard to time, budget & quality. Building consensus and balancing interests between independently managed IT units up to CIO level