ISO 27001 Experts in Munich

• Development of a comprehensive transformation model for IT departments and ITSM organizations, from operational stabilization through structuring and optimization to strategic advancement
• Design of a transformation matrix that connects development phases with the implementation activities Position, Focus, Model, Enable, Anchor and Develop
• Development of assessment, maturity and decision-making logic to determine the operational starting point, the appropriate entry point and the prioritized areas of action
• Structuring of an end-to-end approach from current-state assessment and target vision through operating model, roadmap and service modules to implementation and integration into steady-state operations
• Derivation of combinable consulting and implementation modules, including methods, deliverables, role models, governance structures and transformation paths
• Collection, structuring and prioritization of business requirements from the perspectives of IT management, service management and operational roles
• Translation of requirements into target visions, process and role models, decision criteria and traceable deliverables

Environment / Tools: ITIL 4, IT4IT, Operating Model Canvas, SIAM, maturity models Kanban

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation

In my role as Senior Cloud DevOps Architect for BP, an oil and gas company, I had the mission to migrate the Electric Vehicle Charging platform of the EV Division from on-premises and Azure to AWS cloud, resulting in a hybrid multi-cloud, multi-tenant SaaS solution.

Deployment with Kubernetes for the application layer meant provisioning Kubernetes clusters managed by EKS and AKS, with a focus on integrating them into a multi-tenant environment. This integration was achieved by using Kubernetes namespaces and access controls to ensure data isolation and privacy enforcement.

In the database layer, we chose an RDS instance with PostgreSQL to support the backend infrastructure of our applications. Tenants shared the same RDS instance, but each had a dedicated schema.

To ingest near real-time data from physical charge points (CPOs), as IoT devices, via the OCPI protocol, we ran into significant delays with batch processing. As a result, we built a real-time streaming data pipeline using Apache Kafka, while prioritizing an event-driven architecture.

Led collaboration across multiple internal teams, external vendors, cloud providers, and on-site partners to integrate over five systems into a unified solution.

Achievements:

• Successfully designed and implemented hybrid multi-cloud solutions, integrating multiple cloud platforms (AWS, Azure) with on-premises infrastructure, using Site-to-Site VPNs, Firewalls, and Load Balancing.
• Led the migration of on-premises infrastructure to multi-cloud, multi-tenant infrastructure, resulting in 30% faster processing times.
• Migrated workloads from VMware and Hyper-V environments to cloud-based VMs, leveraging cloud-native services to optimize performance, cost efficiency, and scalability.
• Designed a multi-tenant Kubernetes platform leveraging the Kubernetes ecosystem, using Karpenter for dynamic EC2 node provisioning, KEDA for event-driven pod autoscaling (e.g., Kafka message lag), and Rancher for centralized monitoring of multiple clusters (EKS, AKS, or on-prem K8s), replacing Microsoft-centric Azure Arc management service.
• Designed and implemented Python-based FastAPI microservices as part of the EV core-backend on AWS EKS application layer, powering data ingestion and customer analytics pipelines.
• Developed asynchronous, event-driven APIs (Python-FastAPI) for real-time integration with CPOs, supporting OCPI 2.3 and OICP protocols.
• Designed and implemented a secure, production-grade Azure Databricks platform using Terraform, ensuring scalability and cost efficiency.
• Migrated on-premises ERP to a hybrid Dynamics 365 architecture with ERP hosted locally and CRM running in Azure, integrated via Azure Arc.
• Automated CI/CD pipelines for Databricks notebooks and jobs using GitHub Actions & Databricks CLI, reducing deployment time. Reduced infrastructure provisioning time by 70% by automating cloud resource deployment with GitOps.
• Ensured compliance with internal audit and data governance standards (GDPR) through OAuth2/OIDC-based authentication and fine-grained role-based access controls.
• Developed a Zero Trust security model, enforcing least-privilege access and microsegmentation, enhancing security posture and compliance with GDPR and NIST.
• Built interactive analytics dashboards in Amazon QuickSight, integrating data from S3 and Redshift to deliver real-time business insights and visualizations with embedded access for multi-tenant users.
• Led cloud security assessments and full-lifecycle cybersecurity integration during M&A, covering AWS, Azure, IAM (Entra ID), and data protection, while aligning security posture with NIST, ISO 27001, and GDPR across hybrid and cloud-native environments.
• Reduced cloud costs by 64% for a client's dev environment by implementing automated start/stop schedules for EC2 and RDS instances via AWS CDK with EventBridge Scheduler or AWS Systems Manager.

Tech stack:

• Infrastructure as Code: Terraform, AWS CDK, Ansible.
• Containers: Kubernetes on EKS, AKS, Docker.
• Streaming Data Processing: Kafka to Confluent Cloud, after AWS MSK.
• Frontend: TypeScript, React, NextJS, Hooks, Styled Components.
• Backend: Python with FastAPI, also Node.js with NestJS.
• Database: Aurora on PostgreSQL with TypeORM, RDS on SQL Server, Azure Databricks full setup and administration, ETL Pipelines.
• CI/CD and GitOps: GitHub Actions, Azure DevOps, ArgoCD.
• Monitoring and Observability: Prometheus and Grafana.
• Virtualization: Hyper-V, VMware Cloud on AWS, Azure Migrate.
• ERP Systems: Odoo, Microsoft Dynamics 365 Business Central on Azure, integrated with Azure Arc.
• Networking: Site-to-Site VPNs, AWS Direct Connect, Azure ExpressRoute, Firewalls (AWS Network Firewall, Azure Firewall).
• Security: IAM, NIST Framework, Zero Trust Security, AWS WAF, AWS Shield, GuardDuty.

• As-is assessment of the current network infrastructure and its documentation, including on-site inspections
• Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
• Planning of new copper and fiber optic cabling, including patch panels
• Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
• Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
• Additional support after the components go live (hypercare phase)
• Regular communication with project management and client stakeholders

• Set up Azure Kubernetes clusters (AKS) with network policies, security groups, and RBAC
• Developed Terraform-based infrastructure as code for secure, reproducible deployments in the BMW Azure cloud
• Hardened CI/CD pipelines using Jenkins, SonarQube, Fortify SSC, and Contrast AST
• Integrated SAP BTP/Kyma and ServiceNow GRC

As the Solution Architect for Agentic AI in auto claims processing, I led global customer delivery implementations, encompassing solution design and detailing, multi-tenancy, process flows, integration with third-party solutions, and localization requirements.

• Architectural Analysis: Conducted in-depth analysis of business requirements, managing requirements and creating detailed specifications.
• Service Definition: Developed comprehensive technical definitions for services and integration contracts.
• AI Process Management: Automated AI process management, focusing on analysis, optimization, and continuous improvement.
• Requirements Gathering: Facilitated requirement-gathering sessions and analyzed business processes to identify optimization opportunities.
• Agile Collaboration: Employed agile methodologies, working closely with stakeholders to ensure alignment and responsiveness.
• Technical Support: Assisted senior management with technical analyses and deliverability assessments.

• Cisco SDA LAN network
• Transition and transformation

Two parallel workstreams: (1) Tech due diligence for acquisitions and portfolio companies. (2) AI strategy certification and AI governance consulting.

• Tech assessments for PE/VC acquisitions: code reviews, architecture analysis, scalability evaluation

• Tech assessment frameworks and integration roadmaps for portfolio companies

• TÜV SÜD certification program: AI governance, EU AI regulation (EU AI Act)

• Strategic AI roadmap development for mid-market companies

• Delivered several tech DD reports for investment decisions

• Developed integration roadmaps for portfolio companies

• TÜV SÜD 'AI Strategy & Application Expert' (expected 04/2026)

• Specialized in designing and implementing robust, secure cloud solutions for critical client infrastructure.
• Expertise in Microsoft Intune environment with a strong focus on system hardening and comprehensive policy management.
• Architected NIST and ISO/IEC 27000 compliant Mobile Device Management (MDM) infrastructure tailored for an international government defense aerospace project.
• Performed an architectural role for an offline Microsoft Endpoint Configuration Manager (MECM) environment, ensuring NIST compliance while handling complex manufacturing infrastructure.

• Topics: Business Analysis, Data Privacy, Data Management, Stakeholder Management, Conceptualization
• This project focuses on developing and implementing a strategic approach for data deletion in SAP systems. The goal is to identify the relevant data and structures during system migration to ensure both data privacy and IT system efficiency. At the same time, downtime should be minimized and regulatory requirements met.
• Development of a comprehensive approach for data deletion in SAP systems, considering data privacy and business requirements.
• Ensuring efficient and structured data transfer to the new system.
• Optimizing system efficiency and reducing downtimes during migration.
• Creating functional and technical concepts to ensure compliant and sustainable data management.
• Topic preparation: Detailed study of the "data deletion" area to lay the foundation for a structured data migration.
• Definition of project structure: Setting roles, interfaces and the project's organizational structure.
• Regulatory requirements: Analysis of data privacy regulations and business requirements to define deletion criteria.
• Approach: Developing possible scenarios and methods for data cleansing and deletion.
• Deletion concepts: Creating functional and technical deletion concepts that structure the implementation and provide clear guidelines.
• Setting deletion criteria: Defining which data and structures to delete or transfer.
• Responsibilities: Clarifying responsibilities within the project team and among stakeholders.
• Analysis of ongoing activities: Identifying and collecting existing activities in the "data deletion" area.
• Effort, cost and timeline planning: Creating estimates for resources, effort and budget.
• Implementation initiatives: Developing and executing concrete measures to apply the defined deletion strategies.
• IT system efficiency: Analyzing the existing IT infrastructure to identify optimization potential for data deletion and transfer.
• Technology trends: Evaluating new technologies and tools that can support the data cleansing process.
• Cost-benefit analysis: Assessing the financial impact of data cleansing and the introduction of new solution approaches.
• Risk management: Identifying potential risks during implementation and developing appropriate mitigation measures.
• This project lays the foundation for a sustainable and compliant data transfer to a new SAP system. With a clear approach to data deletion, it meets data privacy requirements, reduces downtimes and increases the efficiency of the new system. The results and recommendations will help companies develop a future-proof data strategy that meets legal and business needs.

• Baseline compliance verification against MAS audit findings
• Building technical architecture concept for 30 technologies to build hardening standard artifacts
• Identifying and building automation possibilities for given technologies based on CIS
• Building the standard baseline configuration based on internal security standard
• Responsible for building Cloud Native Application Protection Platform (CNAPP) architecture artifacts based on Azure cloud platform
• Responsible for RFQ and RFP for different CNAPP solutions (Qualys Total Cloud, CrowdStrike, Azure Security Center)
• Supporting compliance verification and validation via automated scripts for a sample population of IT devices and instances
• Responsible for complete vulnerability management lifecycle using Nexpose, remediation, reporting and integration of results with Splunk, HPSM and Tableau
• Audit support for MAS

• Pre-assessments and review of functional safety status for ADAS ECUs and body controller components
• Conduct functional safety audits
• Review the functional safety status of the E3 1.2 in a pre-assessment
• Document interviews
• Document findings and generate internal reports

Methods:

• ISO26262
• Automotive SPICE Level 2, 3
• Agile methods, SAFe

Tools:

• DOORS
• Enterprise Architect
• JIRA & Confluence
• IQ-FMEA
• Isograph

• Analysis and assessment of government business processes with regard to migration capability
• Definition and preparation of the technical framework conditions in the new master data center
• Development and optimization of migration procedures and processes
• Transformation of existing solutions to new technical standards (technology refresh)
• Coordination of architecture and technical cross-cutting topics

• 21 projects ≥ 6 months at large and medium-sized companies
• 13 projects as project or subproject manager
• 6 international projects with English as project language