Industrial Control System Experts in Germany

• Identified operational improvement opportunities together with production, engineering and management teams.
• Prioritized use cases according to measurable operational value rather than technology availability.
• Developed solutions around production performance, OEE, quality, traceability, reporting and process transparency.
• Translated operational requirements into required machine data, interfaces, information models and application requirements.
• Defined target architectures and integration approaches for heterogeneous brownfield production environments.
• Moved prioritized use cases from workshop and concept stages into concrete implementation projects.
• Coordinated manufacturing, OT, IT and technology stakeholders during implementation.
• Established reusable approaches to scale successful solutions beyond individual machines or pilot areas.

• Advised the executive team on the strategy, architecture, and development of an AI-powered Product Security Operations Center (PSOC); a cybersecurity operating system for software-defined cyber physical connected systems.
• Provided strategic guidance on product vision, regulatory alignment, and market positioning, supporting capabilities across threat intelligence, vulnerability management, compliance automation, and autonomous product security.

• PRISMA project
• Ansible automation
• Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019

• Architected and deployed a live B2B geocoding and demographic-data platform for Germany, combining address lookup with census-based population statistics through a web application and REST API.

• Own product vision and roadmap for Axivion’s AI-enabled software quality and architecture platform (€35M+ ARR) with 12 direct reports (PMs, Marketers, etc.)
• Expanded TAM by 40% by repositioning the product as a compliance backbone for AI-driven, safety-critical software, generating €5M ARR growth
• Influenced €15M R&D investment through C-suite portfolio reviews, aligning innovation priorities with market and regulatory demand
• Enabled entry into regulated industries by accelerating certification readiness by 30%, improving retention and audit outcomes

NIS2 Implementation Project and ISMS Development Based on IT-Grundschutz

Municipal utilities, public-law institution

• Analysis of the current compliance status regarding the requirements of the NIS Directive (NIS-2, EU 2022/2555).
• Identification of critical infrastructures and processes within the organization.
• Development of an action plan to meet NIS requirements.
• Conducting a risk analysis in accordance with BSI Standard 200-3 as the basis for the security concept.
• Preparation of an individual security concept including technical and organizational measures according to BSI IT-Grundschutz.
• Preparatory support for an optional certification according to BSI IT-Grundschutz.
• Adaptation of existing security policies and development of new ones for access controls, incident management and data protection.
• Consideration of municipality-specific requirements and integration of the measures into the existing IT infrastructure.
• Documentation of the results and preparation of audit-ready evidence for audits.

Tools, languages and frameworks used: MS Office, Verinice, IT-Grundschutz (200-x), NIS-2 (EU 2022/2555), ISMS, AI-Act (EU 2024/1989)

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Supported the implementation of §8a requirements of the BSI Act for critical infrastructures.
• Systematically prepared and supported internal and external audits, resolving previous deviations (HA, NA, VP)
• Implemented the specific requirements of the IT security catalog
• Developed training, created run books, and conducted assessments to ensure operational effectiveness.

• Improvement of the Information Security Management System (ISMS) based on ISO 27001, NIS2, DORA, B3S, TISAX and BSI IT Baseline Protection
• Conducting comprehensive gap analyses to identify gaps and derive action plans according to the above standards and regulations; management and KPIs
• Data Loss Prevention strategy and implementation using MS Purview
• Vulnerability and patch management, security monitoring
• Risk analysis and threat modeling using the STRIDE methodology
• Development of vendor risk assessments, implementation of risk classifications, conducting supplier assessments and implementing technical monitoring solutions (e.g. Security ScoreCard)
• Securing cloud environments (AWS and Azure); expertise in CSPM/CNAPP (Wiz), cloud migration, secure CI/CD pipelines, container security and best practices in AWS, Azure and Office 365
• Application security: penetration testing, DevSecOps, OWASP, pre-commit hooks, key and secret management, IDE plugins, static source code analysis, dependency checks, container scanning, vulnerability management, CIS benchmarks and compliance
• Security assessment and hardening according to CIS benchmarks and cloud conformity in AWS, Office 365 and Azure

• Retrofit of wind turbines with innovative technologies

• Set up a project management system based on Atlassian software with the Work Management and Confluence modules

• Developed a workflow for the proposal process for retrofitting existing wind turbines (WKA) and photovoltaic systems (PVA)

• Created business cases and business plans

• Tracked deadlines and content of the project and piloted the workflow in client projects

• Ensured stakeholder acceptance of the project management system

• Introduced and consistently applied agile methods, such as Kanban

• Met deadlines and delivered content for the set milestones

• Acquired industry knowledge

• Successfully implemented Atlassian software

• Specialized in development and implementation of IT and OT security strategies
• Conducting risk analyses, vulnerability management and security assessments
• Administration of Microsoft Cloud and server solutions
• Establishment and maintenance of ISMS according to ISO 27001, NIS2, BSI and IEC 62443
• Planning and management of security projects in industrial and production environments
• Ensuring regulatory compliance with incident response, emergency management and awareness
• Collaboration with business units, management and external service providers
• Preparation of IT infrastructure for audits

• Created and refined technical and compliance-oriented datasets for AI, ensuring high-quality structured documentation.
• Conducted supervised fine-tuning (SFT) and RLHF tasks, maintaining strict alignment with industry and security guidelines.
• Produced detailed technical reports and feedback for audits and QA teams.
• Collaborated with cross-functional teams on documentation strategies for large-scale AI deployments.

Industrial Communication | Proof of Concept: Controller-to-Controller Communication with OPC UA FX

Proof of Concept for OPC UA FX-based controller-to-controller communication between virtual programmable logic controllers (vPLC) on an industrial edge platform. A virtual test environment was set up on Debian Linux in two phases (including VMs and vPLCs), shared-memory communication (real-time information bus) was activated, and the RIB solution was integrated into a customized product firmware (including shared memory and PROFINET support) and deployed in containerized environments (Docker). Additionally, a virtual Ethernet connection was developed to simulate the network topology. Finally, commissioning, functional tests, sample application creation, comprehensive documentation, and customer support were completed.