Juniper Networks Experts in Germany

• User account management and creation in Active Directory
• Group management and updates in Active Directory
• Permissions management on file servers
• Exchange/Outlook support
• VPN setup
• System and product support: Windows 10, Windows 11, Office 2019, Office 365, Active Directory, TeamViewer, RSA VPN, Microsoft Teams, RSA Security Console, Deep Discovery Mail Inspector, ServiceNow, Macmon

• Conceptual consulting for securing business processes
• Consulting for planning and implementing IT and IT security projects
• Security and policy checks, process optimization, contingency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept and for Digid GmbH.
• 2025: Consulting for a customer after a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations for increasing IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Preparation of a DNS concept including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Preparation of a DHCP concept including consulting on DHCP design, the central DHCP management system and automation. Consulting on the operation of the products mentioned, operating processes, and adapting the IT documentation and IT service description for Thyssenkrupp Marine Systems.
• 2024: Analysis and assessment of the network and security infrastructure established by the providers with regard to the overall architecture, consisting of the design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the results, their causes and possible solutions to C-level management, including the required decision templates. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on Zero Trust, redesigning a Cisco ISE implementation and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Bundesanstalt für Geowissenschaften und Rohstoffe (until 05/2023) and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Preparation and review of white papers for infrastructure and security architectures, planning new network infrastructures for Deutsches Luft- und Raumfahrtzentrum.
• 2022: Development of a concept for the technical and process-related modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, introducing Network Access Control and conducting an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for Bundesagentur für Arbeit.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including evaluation and preparation of recommendations for remediation, taking risk and probability of occurrence into account, for customer ifi GmbH.
• 2021: Consulting, concept development and sub-project management for introducing a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic assignment of endpoints) in office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure consisting of the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks and wireless LAN, including support during implementation, for Bundesanstalt für Geowissenschaften und Rohstoffe.
• 2021: Creation of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level-3 policies and preparation of process instructions for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of outsourcing the LAN/WLAN infrastructure to a managed service provider and preparation of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the “Transition of SIEM/SOC Services” project of a customer into a shared environment and assumption of the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop for a future implementation of Mobile Device Management at customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for introducing a rule management tool for firewalls and recertifying NAC endpoints based on 802.1x and MAB at customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recording and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture with regard to the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Development of recommendations to improve the stability and operation of the infrastructure. Preparation of a network segmentation concept and project management for implementing the measures from the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Analysis of the current IT architecture of all 23 companies.
• Recommendations for optimizing the IT infrastructure and preparation of a comparison between a classic perimeter security concept and the Zero Trust model.
• Preparation of a security zone concept.
• Preparation of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the Cyber Security program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network Segmentation and Access Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of offers.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on introducing and initially operating an ISMS based on ISO27001.
• Auditing the IT environments of the GLS country companies.
• Analysis and assessment of IT security risks and derivation of required measures.
• Development of proposed solutions in coordination with the relevant stakeholders.
• Project management and transition of the ISMS to later operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Nationwide strategic and conceptual consulting for major enterprise customers and financial and insurance customers on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and implementation of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Preparation of security policies based on ISO 2700x.
• Assumption of the interim role of Information Security Officer.
• 2017: Preparation of a contingency concept for VPV Lebensversicherungs-AG.
• Review and update of the IT contingency manual.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Preparation of detailed-level designs for cloud products.

"Reasoning Models: From LLM Foundations to NOC Automation."

• As-is assessment of the current network infrastructure and its documentation, including on-site inspections
• Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
• Planning of new copper and fiber optic cabling, including patch panels
• Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
• Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
• Additional support after the components go live (hypercare phase)
• Regular communication with project management and client stakeholders

• Determining the current status (planning status / expansion status) of the so-called interpolygon routes
• Preparing an end-to-end project plan for the individual routes, taking active and passive components and activities into account
• Monitoring and controlling plan implementation
• Optimizing the selected network architecture
• Creating network and splice plans

• It is like a startup within REWE, where we have to build a new forecasting system on Google Cloud Platform from the scratch. Although, officially my role is called MLOps, my actual tasks also include development of data processing pipelines (data engineering) and data scientists tasks such as feature engineering and model trainings.
• GCP: Terraform (tofu), Vertex AI (Kubeflow), Cloud Run, IAM, Google Cloud Storage, BigQuery, Artifact Registry
• Data engineering: Snowflake as the main data warehouse, Terraform, DBT for data model implementations
• CI/CD: GitLab. We have built a CI/CD pipeline that automates deployments of new releases up to production environment
• Development of feature store and data synchronization between environments
• Data science: evaluation of different forecasting models, including CatBoost, Contextual Gamma and Random Forest; implementation of training pipelines using Kubeflow on Vertex AI; scaling and development of an event-driven interface using Kafka as a forecasting service; evaluation of MLFlow for model tracking and model registry
• Implementation of REST API using KeyCloak OAuth2 and OpenID (JWT)
• Monitoring: implementation of dashboards with Grafana, Prometheus, Mimir, Streamlit and Loki to monitor prediction metrics, GCP and Snowflake costs for pipelines, and system metrics
• Development of Copilot Agent Skills

Participation in various projects related to the development and introduction of new telecommunications products in the mobile communications and fixed-line sectors, with a focus on 5G, wholesale and IPv6 technologies.

• Planning, coordination and execution of product development projects, particularly in the 5G and fixed-line environments
• Support for the rollout of new offerings, including test management and quality assurance
• Participation in the development of wholesale products and eSIM solutions
• Close coordination with internal departments (technology, marketing, operations) and external partners
• Use of agile tools and methods for project management and collaboration

Tools: JIRA, MS Office, MS Project

Technologies: 5G, 5G Campus Networks, Fixed Network (FixNet), IPv6, eSIM, Wholesale product development

CS-APN 5G NSA – IPv6 / Dual-Stack for B2B Customers

Ensuring the use of CS-APNs in dual-stack mode (IPv4/IPv6) in combination with MPLS VPN and IPSEC VPN.

• Project management including test planning, test coordination and go-live management
• Technical coordination for activating IPv6 functionality for B2B connections

eSIM Manager – Product Development for B2B Customers

Development of a tool for the fast and scalable provision of eSIM profiles for business customers.

• Product design and process definition for activating eSIMs on different device types (smartphones, IoT, laptops)
• Collaboration with partners to integrate the solution into existing infrastructures

eSIM Handling B2B – Blanco eSIM Process Integration

Optimization of the eSIM provisioning process through the introduction of dynamic Blanco eSIM processes.

• Definition of new processes for issuing non-activated eSIMs (Blanco) via the frontend and partner community
• Design of the integration into service and IT systems

All-IP 5G NSA – Mobile Access for B2B Internet/Voice Services

Expansion of the All-IP portfolio with mobile 5G access offering higher bandwidth for business customers. (5G Indoor Coverage).

• Project management including test management and go-live preparation
• Interface coordination for introducing Local-SIM-based solutions

5G PN – Campus Roaming / Private Networks

Development and introduction of 5G Private Network (PN) solutions with a focus on industrial applications (IIoT).

• Design and definition of business use cases
• Development of SIM/eSIM processes for 5GPN, including roaming between private and public networks

IPv6 for B2B – Introduction in Mobile and Fixed-Line Products

Introduction of IPv6 support for All-IP products and M2M services in the B2B environment.

• Product and process development for integrating IPv6 (in accordance with RIPE-554)
• Implementation for large customers such as retail chains with several thousand branches in Germany and abroad

• Designed and specified the technical network integration of a new business critical application system (MUREX) in the capital market area in a complex interface and outsourcing environment.

• Created component specifications, catalog of measures and implementation plan.

• Ensured proper integration of developed results in accordance with the bank’s framework: IT compliance, IT security, change and release management.

• Selected and integrated a new service provider for the bank; moved critical bank applications to the provider.

• Designed, implemented and supported the new Cisco network and Fortinet security setup at the service provider data center.

• Acted as technical interface between bank, service providers and consulting partners.

• Supported and further developed the network and security infrastructure (clients, servers, networks); performed error analysis and implemented solutions within agreed service levels.

• Analyzed and diagnosed all security and network failures, glitches and malfunctions.

• Initiated continuous enhancements to guarantee efficient resource utilization and acceptable response times to users.

• Provided network support in financial service organization and operational change preparation on production banking network infrastructure for both large and small projects within strict change management discipline.

• Designed, defined, tested, governed and improved engineering standards.

• Performed role of network architect for medium-large projects involving team resources.

• The customer is undergoing a comprehensive transformation. All SAP ECC landscapes worldwide are being migrated to SAP S/4HANA, with the goal of introducing a standard template worldwide.

• The program also includes the “RISE with SAP” migration and modernization program, which may involve migrating the landscapes of selected country installations to the SAP Private Cloud.

• On the stakeholder side, the program reporting line extends to the company’s executive board and that of the implementation partner.

• Fiserv Germany’s ERP landscape currently includes several non-standard SAP tools and applications that extend the functionality of the ECC environment and can often be integrated into downstream systems. As part of the transition to SAP S/4HANA, it is essential to assess the core functionality, integration points and future viability of these applications in order to determine their alignment with the target architecture.

• The focus of the work is on providing expert advice and assessment to define the scope, strategy and roadmap for transitioning Fiserv Germany’s SAP ECC system to SAP S/4HANA.

• The recommended best practices from SAP are followed and a structured approach is used to ensure a smooth transition with minimal disruption while maximizing business value.

• This assessment forms the basis for a successful SAP S/4HANA transformation and ensures alignment with industry best practices, regulatory compliance and future scalability.

• Migration Strategy Definition – assessment of available transition approaches based on business objectives, technical feasibility and SAP Best Practices.

• Technical Readiness Assessment – conducting a system analysis to assess compatibility, custom code impact, data volume management, integration points and infrastructure readiness for SAP S/4HANA.

• Business Process Impact Analysis – reviewing the latest business process documentation to define the scope and effort required to implement the necessary functions in SAP S/4HANA and to identify opportunities for process optimization.

• Roadmap for Non-SAP Systems and Applications – assessment of third-party and legacy applications regarding their integration with SAP S/4HANA and recommendation of consolidation, migration or replacement strategies.

• Deployment & Implementation Planning – defining a phased approach for implementation, including project schedules, risk mitigation strategies and key milestones aligned with business priorities.

• This transformation takes place in phases: the Discovery phase leads to the Explore phase, which is followed by the Design phase and finally implementation.

• Program management

• Change management

• Requirements management

• Transition management

• Stakeholder management

• Risk management

• Comprehensive coordination

• Designed a network management strategy focused on NetDevOps principles and model-driven telemetry using YANG data models
• Conducted NETCONF/YANG workshops for L2VPN/L3VPN services over SRv6
• Automated configuration deployment in the testing environment with Ansible
• Developed end-to-end service measurement concepts with IPSLA and the Telegraf-Prometheus-Grafana stack
• Created the dual-stack architecture design (router + switch + firewall) including a detailed test plan; planned, executed, and documented acceptance tests for the management network
• Performed BSI IT baseline protection checks according to the IT-Grundschutz catalog (needs assessment, modeling, risk analysis, deriving measures)
• Protocols: SRv6, IPv6, MPLS, BGP, ISIS, OSPF, NETCONF/YANG, model-driven telemetry, IPSLA
• Systems: Cisco Crosswork Network Controller, SolarWinds Orion, Grafana, InfluxDB, Telegraf, Ansible, Git
• Components: Cisco NCS router series, Cisco Catalyst switch series, Cisco Firepower firewall series

• Specialized in designing and implementing robust, secure cloud solutions for critical client infrastructure.
• Expertise in Microsoft Intune environment with a strong focus on system hardening and comprehensive policy management.
• Architected NIST and ISO/IEC 27000 compliant Mobile Device Management (MDM) infrastructure tailored for an international government defense aerospace project.
• Performed an architectural role for an offline Microsoft Endpoint Configuration Manager (MECM) environment, ensuring NIST compliance while handling complex manufacturing infrastructure.

• Stabilized the cross-site workplace/printer rollout and transferred it into reliable operational processes. Ongoing hospital operations, new naming conventions, new print servers in a different AD structure, Kerberos dependencies, management systems and inconsistent inventory data.
• Took over technical workstreams and escalated risks at an early stage. Interface between IT operations, project organization, internal employees and external service providers; independently responsible for critical technical workstreams without formal overall project management.
• Fully consolidated the central master/rollout data. Correlated serial number, MAC, IP, location and old/new device references from several sources and established them as a shared working basis for rollout, follow-up work, location and toner processes.
• Technically stabilized the printer rollout. 717 devices in the consolidated rollout scope, including 431 replacement devices; 114 documented deviations. Controlled, created or validated around 2,000 printer/queue objects.
• Proposed Location B as an independent work package and managed it technically. Consolidated 216 old devices into 88 new devices; implemented this in around 10 working days with 1-2 external technicians. Prepared ClearPass, TXT/mapping and ORBIS offset topics in parallel.
• Made several thousand existing TXT/VBS client assignments suitable for bulk migration. Defined old/new mapping, new print servers, Follow-Me, queue, suffix and tray logic; developed checking/correction logic for incorrect manual names.
• Built and productively verified cross-domain FollowMe. Used the historical username attribute to map between the old and new AD domains; stopped further expansion when data quality was no longer reliable.
• Developed the technical approach for hardware/queue reconciliation. Correlated standard lists, print server objects and real devices using IP/SNMP; defined rules for MAC, serial number, IP, location, toner, trays, keep/remove/rename, duplicates and rollback.
• Built AI-assisted automation under time pressure. Developed and stabilized PowerShell/XML tools with independently developed process, data and validation logic, test cases, logging, DryRun/guardrail approaches, error analysis and live validation.
• Designed an HTTP/web platform as a target architecture that was not introduced into production. Technically designed ASP.NET Core 8, .NET Worker, SQLite and PowerShell 5.1 for job control, target/actual comparison, logging/audit, recovery, queueing and locking.
• Operationalized toner, location and operational processes. Consolidated TA-Cockpit location data; established toner/order logic with prioritized run lists; supported Follow-Me, duplex and Scan2Mail pilots.
• Worked out the KRITIS/emergency topic in detail. Structured and visualized printer operations during power/infrastructure failures, coordinated internally and supported the integration into the emergency concept.
• Coordinated the workplace/IGEL client rollout with 1.200+ thin clients from a technical and operational perspective. Prepared the project from 11/2025 and continued it from mid-09/2026. Technically reviewed and structured the process from unpacking and labeling/inventory to setup; handed over operational unpacking/label coordination to a colleague so several employees could work in parallel.
• Personally prepared around 120 thin clients for production. Together with a technical colleague, primarily responsible for finding a solution for automated IGEL-OS-12 installation; productive automation is currently still open.
• Saved around 83 hours of manual ClearPass data entry. Created a PowerShell/import script for ClearPass and demonstrably saved the network colleague around 83 hours of manual entry for 1.200 thin clients; at the same time, significantly reduced the risk of manual errors.
• Supplied formal project management with technical results. Operational results, technical feasibility, process structure and status from the responsible workstreams serve as an important basis for steering by the official project manager.
• Documentation & handover. Documented rollout, AQrate, TA-Cockpit and automation processes, conducted training and tested, configured and prepared around 25 digital medical carts for operation.

• Manage the development release and update process for a digitized nationwide trade register project "AuRegis".

• Support software in Kubernetes/OpenShift environments, configure management with Kustomize, and implement CI/CD pipelines using Jenkins/GitLab, SonarQube, ArgoCD, and Azure.

• Oversee system release of microservice architecture.

• Build the CI/CD stack from scratch with GitLab CI, integrating integration tests, dependency checks, and security measures.

• Automate deployment onto OpenShift using Kustomize.

• Set up infrastructure components for development, code review, and code quality analysis including SonarQube.

• Integrate GitOps tools such as Kustomize and ArgoCD, using both Azure and private cloud for sensitive data handling.

• Develop Python scripts in Jenkins for cryptostore configuration and system packaging of products and microservices into deployable units.

• Automate delivery to customers and deployment on test systems.

• Create Kustomize manifests for microservices and develop the related automation, treating documentation as code for clarity and reproducibility.

• Serve as technical advisor for the project's first go-live and oversee further deployments as technical rollout manager.

• Responsible for the configuration, maintenance, monitoring, troubleshooting, and optimization of the IT infrastructure, including Extreme Networks, SD-WAN, and Fortinet security solutions, at all international company locations in Europe and North America
• Development of a comprehensive strategic roadmap to optimize the network architecture, including VLANS, NAC, QoS, firewall configurations, VPNs, DPI, NGFW, threat intelligence, and SSL/TLS inspection
• Implementation of the OneIT strategy through the introduction of new technologies such as Cisco DNA Center, ExtremeCloud IQ, FortiOS, FortiManager, and FortiAnalyzer, which increased employee skills and the efficiency of the IT systems
• Integration of IT and OT systems to optimize the network and security architecture and improve operational efficiency