Infrastructure as a Service Experts in Germany

Evidence-led health intelligence platform turning published research into personal health protocols. It scores 430 habits, foods, and supplements against the studies behind them, and moves the score when the evidence moves. Built solo.

• Built the daily ingestion pipeline across PubMed, bioRxiv, and medRxiv: 43,000+ papers from 3,400+ journals processed into 230,000+ typed evidence claims, each one traceable back to the study it came from.
• Designed the six-factor evidence scoring model and the public changelog behind it, so no recommendation ever appears without the papers underneath it. 23,000+ grade changes recorded and explained to date.
• Shipped an entity information model connecting every intervention to its mechanisms, biomarkers, and outcomes: 118 biomarkers with region-specific reference ranges, 77 mechanisms, 32 graded outcomes.
• Built the personalisation layer: blood panel ingestion that reads lab PDFs with a vision model and corrects results for draw time against the user's wake anchor, plus Oura, WHOOP, and Withings integration for daily readiness context.
• Operate eleven specialised review agents over the corpus and codebase, covering paper curation, retrieval quality, health-claim compliance across EU and US regimes, and security.
• Shipped the Evidence Assistant, a RAG assistant that answers from the claim database and cites the underlying papers, plus a B2B practitioner tier, an Expo React Native app, and localisation across 3 languages and 7 markets.

Stack: Next.js 16, TypeScript, Supabase, pgvector, Anthropic Claude, Vercel, DeepInfra.

Creation of concepts for M365 implementation, especially Tenants, EntraID, EntraConnect and ExchangeOnline, taking BAS standards into account (mandatory baseline security requirements) in the project "Concept M365" with the aim of transferring the concepts to the M365 environments of Bitmarck and then handing them over to the customer.

• Creation of a current-state analysis of the existing M365 environments as well as the on-premises environments and the BAS standards.
• Creation of concepts for the topics Tenants, EntraID, EntraConnect and ExchangeOnline taking the BAS standards into account
• Design and implementation of an automated solution for creating standardized M365 tenants based on Microsoft M365 DSC (Desired State Configuration)
• Transfer of the concepts into the M365 environments
• Creation of detailed technical documentation

• Training AI models, evaluating images and text UI/UX, turning the provided data into insights through OpenAI Feather as part of the machine learning workflow

Technologies: OpenAI Feather

• Short description: Lead a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations control while preserving the autonomy of decentralized business units within regulatory boundaries.

• Tasks and activities:

• Overall responsibility for the design, setup, and implementation of an enterprise-wide cloud governance structure (Azure), incl. target picture, roadmap, and operating model.

• Management of internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps) incl. decision-making and escalation management.

• Planning and facilitation of workshops on cloud strategy, governance principles, and the design of areas such as Identity, Connectivity, and Platform Management.

• Definition, implementation, and rollout of cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).

• Building a cloud governance framework aligned with the Azure Cloud Adoption Framework (CAF), incl. landing zone and guardrail concepts.

• Introduction of automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).

• Implementation of cloud security and compliance monitoring mechanisms as well as continuous improvement processes.

• Establishment and operationalization of FinOps in an enterprise environment (central and decentralized FinOps teams), incl. cost management strategies, reporting, and guardrails.

• Integration of governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).

• Implementation of access concepts incl. RBAC design and "break glass" mechanisms (emergency access) as well as certificate automation (ACME / step-ca).

• Achievements:

• Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud usage in a regulated environment.

• Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.

• Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).

• Significantly increased workload compliance for lift-and-shift migrations.

• Technologies used:

• Microsoft Azure Policy, custom policies.

• Terraform, OpenTofu, Terragrunt.

• step-ca (ACME).

• Entra ID.

• Azure Firewall.

• Azure networking, hub-and-spoke architecture.

• Azure vWAN (evaluation).

• Azure Front Door, Azure Application Gateway.

• Azure ExpressRoute.

• Azure Key Vault.

• NetBox.

• GitLab (on-premises).

• Infrastructure, concepts used:

• Cloud shared responsibility model.

• Hub-and-spoke connectivity / central shared services (from a hub-spoke context).

• Central governance with decentralized delivery (business unit autonomy with guardrails).

• Methods used:

• Scrum.

• Stakeholder management (C-level to engineering).

• Cloud governance, Azure Cloud Adoption Framework (CAF).

• DevOps, CI/CD.

• Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.

• RBAC, "break glass" concepts.

• ACME / certificate automation.

• GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.

Project: Design and implementation of an AI product for four business use cases

Project management for an AI project at a leading provider of large-scale catering and food services, where a production-ready AI product for four use cases was implemented together with an external development partner: automated briefings based on CRM and document data, voice-based capture and structuring of reports, detection and consolidation of duplicates in master data, and data-based market analyses. A key focus was a data-protection-compliant architecture that passed the internal IT security review and enabled production use.

• Translation of business requirements into clearly defined AI use cases with a focused product scope and clear value proposition
• Selection and evaluation of models and architecture options for text extraction, speech-to-text, and context enrichment from business systems, including LLM integration, function calling, and retrieval
• Development and implementation of an architecture with European hosting, data minimization, and masking of personal data as a prerequisite for approval
• Management of interfaces between business departments, IT, IT security, and the external development partner under restrictive data access conditions
• Coordination with the CIO and executive management levels on data access, risk assessment, and approval decisions
• Preparation for the transition to production use

• Error analysis and fixes including performance optimization of the in-house developed platform API
• Change and incident management in day-to-day operations
• Responsible for compliance with security and compliance requirements
• Vendor management for software development and maintenance
• Planning and execution of migration of legacy services to a cloud native platform

Role in the project: project staff, implementation team

Used skills: requirements analysis, IT service and application management, IT operations, error analysis and performance optimization, software maintenance and lifecycle management

Project environment: Cloud Native Platform (Kubernetes, Crossplane, AWS, ArgoCD, Grafana)

• Design and build of a fully isolated AWS offline environment with no outbound internet access for running a browser-based business application
• Design and implementation of a proxy and response service that terminates all external application calls inside the VPC and serves them from locally stored content; identification of the actual communication needs through measurement-based DNS query logging
• Creation of architecture designs and decision papers including a comparison of options (Application Load Balancer with Lambda and S3, reverse proxy on EC2, private API Gateway) assessed by operational effort, cost, and availability
• Transfer of the solution and operations documentation previously available only for Azure to an AWS target architecture, including reassignment of all services and operational processes
• Automated rollout as Infrastructure as Code (Terraform, CloudFormation) with CI deployment via GitHub Actions, plus setup of private DNS zones and an internal certificate chain for operation without internet access
• Creation of architecture, deployment, and operations documentation and handover to the customer
• Build-up of a private cloud platform on OpenStack at provider TelemaxX with Terraform, including FortiGate HA clusters, FortiManager, and Kubernetes
• Introduction of Policy as Code (Open Policy Agent, Conftest) as well as development of MCP servers (Model Context Protocol) to connect AI assistants to operations and project tools

Successes:

• Made the business application fully operable without internet access for the first time; the cause of the loading error was narrowed down systematically to missing CORS headers after the likely certificate issue was ruled out
• Fully transferred an existing Azure concept to AWS and replaced the manually created environment with a reproducible, CI-based rollout

Technology stack: AWS (VPC, Application Load Balancer, Lambda, S3, Route 53 private hosted zones and Resolver query logging, IAM, CloudWatch, EC2, CloudFormation), Infrastructure as Code (Terraform, CloudFormation, Remote State), CI/CD (GitHub Actions with OIDC, Azure DevOps Pipelines), OpenStack, FortiGate, FortiManager, Kubernetes, Policy as Code (Open Policy Agent, Conftest), offline and air-gap architectures, PKI & certificates (internal CA, TLS, CRL/OCSP), DNS, network segmentation, Linux, Windows Server, Python, Bash, PowerShell, YAML, JSON, architecture design & decision papers, documentation (Confluence, Markdown), Generative & Agentic AI (Model Context Protocol, Agentic AI Coding Tools)

Zerobits is my vehicle for AI-powered automation and custom software development with a clear principle: AI solutions that reach production, not pilot stage. I design and build the systems myself - from first concept and architecture through implementation to deployment and operations.

My focus is on replacing repetitive, manual work with reliable automation and connecting disconnected tools and data sources into one dependable overall system.

Selected work:

• Design and implementation of LLM-based agent systems and RAG pipelines (Anthropic Claude, Mistral, MongoDB Atlas Vector Search + RAG)
• Workflow orchestration for long-running, fault-tolerant business processes using Temporal (temporal.io): saga patterns, event-driven architecture, retry and compensation logic, connecting third-party APIs and internal services into automated end-to-end processes
• Full stack product development: SaaS architecture on Kubernetes, TypeScript/React/NestJS, admin tooling with refine.dev and MUI
• AI-assisted development workflow as standard practice to deliver production software at a fraction of traditional timelines
• Full stack product development: multi-tenant SaaS architecture running on Kubernetes, backend with NestJS/Node.js and Python, frontend with TypeScript, React and Next.js, admin tooling with refine.dev and MUI, CI/CD with GitHub Actions

One of these projects is a product I own and operate - free of any NDA restrictions. I'm happy to demonstrate it end to end.

• PRISMA project
• Ansible automation
• Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019

Predapp is a Sovereign AI and Infrastructure company building AI systems that organisations can own, control, and deploy on their terms, with full data sovereignty. As CTO and investor since 2015, leading the development of the Sovereign AI Platform alongside an advisory practice spanning AI strategy for enterprises, fractional CTO engagements, and technical due diligence for VCs, PE, and family offices.

• Architected the Sovereign AI Platform from zero owning technical vision, infrastructure design, and engineering roadmap; currently deployed at a European hospital, an automotive client in Germany, and two US startups, with active commercial discussions with two leading European hosting providers
• Dubai Health Authority (DHA / Nabidh): Designed and trained AI symptom checker and triage system for national 'Doctor for Every Citizen' initiative under HH Sheikh Mohammed bin Rashid Al Maktoum
• Emirates Airlines: Designed and deployed AI agent for ground personnel accelerating training, improving issue handling, and reducing cost of liquid workforce
• Developed explainable AI triage system piloted at University Hospital Heidelberg and Famagusta Hospital (Cyprus); reduced patient wait times by up to 15% (validation ongoing)
• Built production scheduling engine for US industrial AI startup: RL + Monte Carlo tree search, reducing planning from hours to seconds
• Designed and led the development of semantic search engines using RAG + Knowledge Graphs; developed Agentic Text-to-SQL solution for citizen data scientists
• AI strategy advisory and readiness assessments for enterprise clients, including architecture reviews, maturity assessments, and AI roadmap development

• Create an AI legal assistant with modern ML capabilities.
• Implement RAG architecture, with data pipelines for legal data search.
• Use AWS Bedrock for LLM and embedding models and LangChain/LangGraph
• Python with FastApi for backend and React for frontend

• Disciplinary and professional leadership of the IT and service team
• Definition and documentation of the Current Mode of Operation (CMO) in Confluence: application landscape, infrastructure, networks, backup & storage
• Development of the Future Mode of Operation (FMO) including process analysis & stakeholder interviews with all departments using BPMN and flowcharts
• Optimization of license management: reduction of ongoing software costs by approx. 17% p.a.
• Introduction and establishment of Jira as the central tool for project and service management
• Introduction and rollout of the HR software MindKey to digitize HR processes
• Introduction of a VoIP solution with Microsoft Teams incl. PSTN connection to replace classic telephony
• Introduction of the production and planning software OptiControl to digitize operational processes
• Rollout of Intune as a Mobile Device Management solution for Windows, iOS and Android
• Build-up of Power BI dashboards for machine park monitoring and financial reporting
• Planning and execution of the IT consolidation of two locations for 170 users
• Introduction of automated penetration testing with Pentera
• Coaching and mentoring the team in agile methods & project management
• Operational support in day-to-day business: administration, incident & change management
• Management of external service providers and assurance of the quality of outsourced IT services
• Responsibility for the IT budget incl. planning and controlling
• Direct reporting line to management with regular management reports on IT KPIs, budget and project status

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Technical leadership and architecture for enterprise clients (including LR Health & Beauty, Deutsche Bahn, Trusted Shops)
• Cloud migration, microservices architectures, CI/CD optimization