Incident Response Experts in Germany

• Led the migration from legacy access systems to a software-defined, disaggregated network architecture within Deutsche Telekom’s Access 4.0 program.
• Coordinated large-scale network migrations across multiple sites.
• Ensured stable and controlled migration of millions of customer connections.
• Managed cross-functional activities to minimize operational risks and ensure seamless transitions.

• Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.

• Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.

• Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.

• Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.

• Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.

• Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.

• Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.

• Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.

• Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.

• Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.

• Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.

• Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.

• Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.

• Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.

• Result: >99.5% uptime over 20+ years and zero compromises.

• Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.

• Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.

• Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, vulnerability management policy, business resilience programme, risk governance plan
• Consolidation into an integrated emergency handbook (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table, and a formal approval structure
• Review of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with documented compensating control
• Review and documentation of NIS2 and HinSchG applicability, including the legal reasoning for non-applicability

• Led migration to GCP using Terraform, GKE, and GitOps, improving deployment consistency and scalability
• Implemented Datadog observability stack via Terraform and datadog-operator
• Established automated end-to-end tests and on-call processes, improving incident response and service reliability
• Migrated from NGINX Ingress Controller to Kubernetes Gateway API (NGINX Gateway Fabric)
• Migrated stateful services (PostgreSQL and Redis) to GCP, improving scalability and operational reliability

• Technical program ownership for the IPv6 migration at DRV RP and DRV BW, with a focus on migration planning, execution structure, and cross-functional technical coordination.
• Designed and implemented an operational control model with dashboard, action board, KPI portfolio, risk register, and decision index to translate technical topics into structured delivery artifacts.
• Coordinated technical groundwork for architecture and rollout across IPv6 addressing, segmentation, dual-stack target design, test-lab planning, and cross-team dependencies.
• Supported security and compliance-related requirements in the context of BSI, NIS2, and critical infrastructure, translating them into traceable evidence, risks, and management reporting.
• Achievement: Established a reusable intake-to-governance workflow for systematically capturing technical actions, risks, open issues, and evidence requirements.
• Achievement: Created an operational baseline for technical program execution with measurable KPIs, clear ownership, and transparent decision support.

Volunteer helper at the Johanniter in medical services and disaster response, highlighting teamwork and coordination even in times of crisis.

• Perform secure code reviews and provide secure-coding guidance across the application and platform architecture.
• Engineer infrastructure security and design security-monitoring architecture, incident-response playbooks and Security-by-Design controls.

PMO support at a leading European wholesaler of photovoltaic systems, battery storage, and charging stations. Focus on optimizing and rebuilding IT service management processes in Jira.

• Reworking existing Jira workflows for IT Service Management (helpdesk)
• Setting up new Jira Service Management projects, including for an incident response process: workflow adjustments, frontend design, and full process development
• Global administration for Jira Service Management projects as well as organizational administration
• Setting up new spaces for different service desks within the company
• Support in meetings, including minute-taking and follow-up
• KPI tracking for IT service management processes (ticket throughput times, SLA compliance, backlog development) with transparent stakeholder reporting
• Implementation of the operational project plan

Environment: Jira, Jira Service Management, Confluence, Microsoft Teams

• Codebase Evaluation & Problem Design: Designed and stress-tested complex software engineering problems against large open-source Python codebases (including pandas), requiring deep context acquisition and architectural understanding to produce well-scoped, realistic problem statements aligned to strict correctness guidelines.
• Agent Failure Analysis: Assessed LLM coding agent solutions for correctness and completeness, identifying meaningful failures across edge case handling, dtype behaviour, and multi-column NaN propagation logic; documented findings with precision for downstream evaluation use.
• Programmatic Test Suite Development: Authored comprehensive pytest suites to programmatically verify agent-generated solutions against defined requirements, with deliberate coverage of boundary conditions and failure modes not caught by naive implementations.
• Containerised Environment Engineering: Built and debugged Docker environments for reproducible agent execution, including git-based repository provisioning, dependency pinning with npm ci, and multi-stage Dockerfile authoring across Linux-based containers.

traigo is VTG's digital rail logistics and fleet management platform. It processes large volumes of telemetry, mileage, geofence, sensor and wagon-movement events in near real time and provides operational services for rail logistics customers across Europe.

As part of Team Customer Selfcare, I worked on the design, implementation, optimisation and operation of large-scale backend services and event-driven processing pipelines — covering both feature development and operational ownership of business-critical production systems. I also regularly acted as first responder for production incidents, data inconsistencies and performance investigations across multiple distributed services.

• Design and implementation of event-driven backend services.
• Migration and replacement of legacy processing pipelines.
• Development of replay / rebuild mechanisms for large event datasets.
• High-throughput asynchronous event processing on SNS / SQS.
• Database and query optimisation for PostgreSQL and DynamoDB.
• Design of scalable read / write models and aggregation pipelines.
• Production troubleshooting and operational support.
• Performance tuning and infrastructure scaling.
• Design and stabilisation of integration and system tests.
• Technical concepts, architecture documentation, and cross-team collaboration.
• Support the further development of existing GitLab CI/CD pipelines

Geofence & Wagon Stay Processing

• Algorithm to detect vehicles within geofences (entry, exit, dwell time).
• Event sourcing with guaranteed chronological order within the affected time window.
• Refactored geofence event and wagon-stay processing logic for performance.
• Resolved race conditions and event-ordering problems in distributed services; server-side filtering, aggregation and optimised query pipelines.
• Repair and replay tooling for corrupted or inconsistent movement data.

Fleet Metadata & Mileage

• Modernised the service; migrated storage from DynamoDB to PostgreSQL to improve traceability and accelerate new features.
• Scalable mileage aggregation and replay mechanisms.
• Read / write models and optimised queries for high-volume mileage calculations.

Sensor & Telematics Integration

• Integrated telemetry and sensor processing pipelines.
• Snapshot and state-calculation logic for sensor systems.
• APIs and persistence models for wagon sensor data; data-quality improvements.
• Further development of a service using gRPC for intra-service communication.

Movement Segment Processing & Routing

• Migrated services to new movement-segment event streams.
• Built replay and rebuild tooling for segment correction.
• Optimised throughput and reliability for high-volume event processing.

Condition Monitoring & Wagon Analytics

• APIs and backend services for wagon condition monitoring.
• Brake-wear prediction processing and wagon analytics functionality.
• PostgreSQL views and optimised query models for operational dashboards.

Operational Reliability - First Responder

• Investigated production incidents and distributed-system failures; DLQ analysis, replay and operational recovery.
• Tuned database performance and AWS infrastructure under production load.
• Improved observability, monitoring and operational tooling.
• Supported rollout strategies, monitoring and post-deployment stabilisation.

OpsWorker turns Kubernetes alerts into root-cause analyses, on top of the monitoring a team already runs. I lead the technical side: the agent architecture, the AWS infrastructure it runs on (fully inside EU regions), and the engineering decisions behind it, read-only in the cluster by default, human in the loop for judgment. The stack underneath: Amazon Bedrock and Bedrock AgentCore, agents built with the Strands Agents SDK, the Claude and OpenAI APIs, and the Kubernetes API.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Senior program director and enterprise architect with nearly 30 years of operational experience in HR, ERP, security, risk management, finance, PLM and SLM.
• Expertise in IT program and project management, engineering, process management and organizational development.
• Experience working for the world leader in service management software, rail transportation and a leading tier 1 automotive supplier.
• Subject matter expertise in finance, automation processes, logistics, ERP and PLM and integration, including related end-to-end lifecycle data management and enterprise architecture.
• Specializes in managing large and complex engagements, programs and projects from demand, idea and strategy to operation, including stakeholder and change management.
• Expertise areas: HR, ERP, SecOps, integrated risk management, supply chain and operations, finance, SLM, product strategy, lifecycle management, shared services, IT and PLM.
• Industry experience in technology, tier 1 automotive, transportation and logistics, manufacturing, high technology and software industries, banking and insurance, and railway.
• Experience with SecOps (security incident response and vulnerability management), digital portfolio management, integrated risk management, service portfolio management and business continuity planning.
• Experience defining and designing integrated risk management including security and operations (response plans), CMDB initiatives and shared service implementations.
• Implemented integrated risk management including digital business continuity plans, disaster recovery plans, digital maturity assessments and security risk registers.
• Technology skills include SAP, HR, time and attendance, ERP, PLM, ALM, ITSM and CAD systems.
• Experience with cloud-based services and master data management.
• Familiar with TOGAF, IT4IT, SAFe and PPM.
• Project client exposure to companies such as Siemens, BMW, Daimler, BASF, Bayer, Bosch, DHL, DB Schenker, ServiceNow, Bombardier, KION, Johnson Controls, Schaeffler, Deutsche Telekom, SAP, FEMSA, CEMEX, Nestlé, Heineken, Air France/KLM, Airbus, Vodafone, Majorel, Virgin Trains, Equinor, ASML and Volvo.
• Holds a master’s degree in informatics and a bachelor’s degree in applied economics.

• Analysis of the fiber optic market with a focus on FTTH
• Advising senior management on strategy planning for the next 10 years
• Reviewing product portfolios and services
• Identifying cost-saving opportunities
• Planning restructuring measures as part of a transformation program
• Designing a program structure "Fit For Profit" to implement the planned restructuring and meet strategic objectives