JWT Experts in Germany

Maturing their API practices on both a business and technology level. My role covers strategy, architecture, developer advocacy as well as hands-on software engineering, enabling both technical teams and business leadership to adopt and act on API-centric principles effectively. Coincidentally, we also establish GitOps, DX and platform best practices with this project.

Highlights:

• Aligning executives with the initiative by clarifying strategy, replacing misconceptions and myths with facts, clarifying the value of existing assets and enabling informed decision-making
• Formulating a way forward for API Lifecycle Management at OTTO
• Driving platform progress and fostering developer engagement by hands-on engineering work towards strategic goals

API Lifecycle Management, Team Topologies, Organizational Evolution, Regulatory, Platform Advocate, Developer Platform, Communities of Practice, Terraform, Kotlin, Kafka, Kong, WSO2, Apigee, Gravitee, Backstage, AsyncAPI, OpenAPI, API Design, AWS, React, Node.js, TypeScript, Redocly, reactive programming, CDC, Golang, Gin, GitOps, DX (developer experience), stakeholder management, roadmaps, workshops, discovery.

• Focus: System architecture, cloud-native platforms, microservices, API design
• Product: Pflege-Pfad is a digital placement platform that directly connects relatives of people in need of care with verified care services and caregivers – without an agency and without ongoing fees.
• Business analysis & process design:
• Analysis of the German care market and identification of the key pain points of both target groups.
• Modeling of core business processes: registration, verification, care request, application, placement, and rating.
• Definition of the business model as a freemium/premium model with optional contact unlocking.
• Creation of user stories and requirements documentation for relatives, care services, and administrators.
• Design of trust and quality assurance mechanisms with document upload, admin review process, and rating system.
• Coordination with stakeholders and validation of product decisions with potential users.
• Technical implementation:
• Design and implementation of the entire platform architecture as the sole developer.
• Design and implementation of a REST API with Spring Boot and Kotlin, including JWT-based authentication.
• Development of the frontend as a single-page application with Angular 17.
• Implementation of the AWS infrastructure with EC2, RDS PostgreSQL, S3, CloudFront, and IAM.
• Document upload with AWS S3 using presigned URLs to verify care services.
• Email notifications via Resend API.
• AI-supported care service search via OpenAI API.
• Implementation of complete user flows such as registration, login, password reset, and the placement process.
• Development of an admin panel for user and care service management as well as analytics.
• CI/CD with GitHub Actions and containerized deployments with Docker.
• End-to-end tests with Playwright.

Technologies: Kotlin, Spring Boot 3, Spring Security, JWT, JPA/Hibernate, PostgreSQL, Angular 17, TypeScript, RxJS, AWS (EC2, ECS, S3, CloudFront CDN, RDS PostgreSQL, IAM), nginx, GitHub Actions, Playwright, Maven, Git, OpenAI API, Resend API, Docker, Scrum, i18n (DE/EN/TR), Kiro, feature flag architecture.

Built an international e-commerce platform for a multi-vendor marketplace for digital assets from scratch. Designed and operated cloud native architectures at enterprise scale.

• Designed and operated a highly scalable microservice and serverless architecture
• Built the complete cloud infrastructure with Terraform + AWS CDK in AWS
• Provisioned ECS/EKS clusters (Fargate), Application Load Balancers (reverse proxy), and Lambda functions
• Observability & tracing with CloudWatch, DataDog, Prometheus, and Grafana
• End-to-end setup with DataDog (formerly AWS CloudWatch), Prometheus, and custom Grafana dashboards
• Integration of advanced metrics (including ORM mapper) and distributed tracing with Jaeger
• Robust backup and disaster recovery strategies
• RDS Postgres backups and hourly snapshots
• Read-only, asynchronously synchronized replicas with automated master failover in emergencies
• Minute-level rollback capability through versioned Docker images on ECS and Git-based CI/CD pipelines
• Created CI/CD pipelines with GitHub Actions for automated multi-stage deployments (Dev, Testing, Prod)
• Integrated Stripe for international payment processing
• Built a marketplace payment system with multiple parties and payout routines
• Used Algolia for high-performance real-time search of digital assets on the platform
• Federation of services with GraphQL and Hasura
• Later migration to GraphQL Mesh
• Test Driven Development (TDD) - unit, integration, and E2E testing with Jest, Vitest, and Playwright
• Used Next.js / React for modern frontend applications in the nx monorepo
• Enterprise security architecture & access control
• Integration of JWT tokens with Auth0, OAuth, OIDC, IP guards, BOLA protection, and secret vaults
• Authorization concepts with RBAC, ABAC, and native Postgres Row-Level Security (RLS)
• Built internal microfrontends with Retool for fast prototyping and operational business processes

Technologies: ABAC, AWS CDK, AWS CloudWatch, AWS ECS, AWS EKS, AWS Fargate, AWS RDS, AWS S3, Algolia, Auth0, DataDog, Docker, GitHub Actions, Grafana, GraphQL, GraphQL Mesh, Hasura, JWT, Jaeger, Java, JavaScript, Jest, Kotlin, Kubernetes, Monorepo, Next.js, OIDC, Playwright, Postgres, Postgres RLS, Prometheus, RBAC, Redis, Retool, Serverless, Stripe, Terraform, TypeScript, Vitest

• Worked as freelance Senior DevOps Consultant on-site for IBM at a European Union Agency, operating in a highly secure, air-gapped environment managing classified systems.
• Led automation and DevOps initiatives for a large-scale OpenShift platform (>400 nodes), driving deployment efficiency, GitOps adoption, and operational automation using Ansible, Python, and Bash while ensuring compliance with security requirements.
• Spearheaded automation of release and deployment workflows in a private cloud environment hosting 400+ OpenShift nodes, significantly improving deployment speed and reliability.
• Migrated existing playbooks, roles, and templates from Ansible Tower to Ansible Automation Platform (AAP), ensuring full compliance with fully-qualified collection names (FQCN) and preparing custom Execution Environments (EE) for containerized automation.
• Implemented GitOps Agent for AAP Controller Configuration as Code, enabling automated synchronization (CRUD) of Ansible Controller objects based on repository-stored configuration definitions using GitHub webhooks.
• Designed and automated complex multi-step operational workflows including environment cleanup, Helix cluster component re-creation, Kafka topic management, and OpenShift object lifecycle management across ~100 environments.
• Achieved a reduction of multi-day manual operations to under a few hours through automation improvements spanning multiple AAP clusters and OpenShift environments.
• Integrated Ansible Automation Platform with Thycotic (Delinea) Secret Server via lookup plugin to enhance secure credential management in automated processes.
• Managed deployment tasks, platform troubleshooting, and Istio network configurations while adhering to stringent EU PSC security and compliance standards.
• Collaborated with infrastructure and application teams to refine deployment procedures, develop naming conventions, and continuously improve automation coverage in an air-gapped, classified environment.

• Fully on-premises LLM document-examination platform for a compliance-critical banking domain: agentic LangGraph pipeline with deterministic verification, every AI judgment structured and source-anchored; ~960 automated tests, zero data egress
• GPU throughput engineering (quantized serving, speculative decoding, prefix caching): 9.5x extraction speed-up, 500+ multi-document case files per day on a single A100
• AI-native EDI/EDIFACT integration platform (~116k LOC Java 25 / Spring Boot 4, 1,900+ tests): LLM-drafted partner mappings machine-verified before go-live (DFDL conformance, field-coverage checks, dry runs), ~99.5% byte match on real customer files — replacing weeks of manual mapping per partner

• Designed a migration strategy for WLS applications to BKA Cloud and Stack IT

• Created a hybrid cloud for internal testing and development with Kubernetes

• Transformed the IT landscape from an outdated monolithic architecture to a cloud-based architecture

• Integrated new CI/CD processes using Azure Pipelines

• Quadrupled the processing throughput for personnel security checks

• Migrated personnel security screening applications to Docker-based applications

• Implemented CI/deployment pipelines using Azure DevOps

• Environment: Java Springboot, Kubernetes, Oracle Weblogic, OpenID, Camunda, JUnit, TOGAF

Multi-Agent Document-Generation Platform

Problem:

Turn a single prompt into a well-researched, structured and cited document, while keeping the user in control: every stage can be reviewed, corrected or revisited before the system moves on.

Architecture:

A multi-agent system orchestrated by a central controller. More than 20 specialised pydantic-ai subagents (understanding, structuring, planning, research, writing, assembly, cross-reference check, glossary, citation, reference table and more) pass results forward through a shared plan persisted in Postgres (asyncpg); a runner layer dispatches each task by name to its agent, and mechanical steps such as formatting, table of contents and list of figures are deterministic code instead of LLM calls. Provider (Anthropic or OpenAI) is a configuration setting, and responses stream over Server-Sent Events.

Hosting & Infrastructure:

Stateless container run as a Scaleway Serverless Container on a private network with managed PostgreSQL, object storage for finished documents and assets, and centralized log shipping (Loki / Scaleway Cockpit), provisioned with OpenTofu modules and deployed through GitLab CI; usage is metered per API key.

My Contribution & Key Decisions:

• Central decision controller: a satisfaction classifier turns the user's free-text feedback into a verdict (keep working, advance, cancel or revise an earlier task), and a middleware applies it to the plan. Plan progression supports jumping back to earlier tasks and re-running the stages after them.
• Research and writing fan-out: planning produces a plan from which a research-design agent generates individual research tasks and a writing-design agent generates individual writing tasks, each linked to the research it needs. Every task runs in its own dedicated agent with its own conversation history.
• Self-review and human-in-the-loop: after each step a critical-thinking agent reviews the output; the user can accept, refine, or ask questions about a critique before the plan advances.
• MCP integrations: two remote MCP servers, web search and internal document search, connected through pydantic-ai with retries and long-running tool-call timeouts. Classifier agents decide per task whether web search is needed, and a small model condenses raw search results into structured findings before they reach the writing agents.

Usage Metering:

Clients authenticate with an API key validated against a key-management service; consumption is charged in credits calculated from token usage per model plus a markup, and exhausted quota is answered with HTTP 429.

Red Hat OpenShift Container Platform

Scope:

• Operation and configuration of the Red Hat OpenShift Container Platform, including network, storage, and security design.
• Implementation of centralized observability solutions (Prometheus, Grafana, alerting).
• Development of CI/CD pipelines, GitOps workflows, and automation frameworks.
• Training and enablement of operations and development teams.

Result: Accelerated service delivery, transparent operational metrics, and sustainable knowledge transfer.

• Recurring problem in my own AI-assisted projects: requirements analysis, use cases, and architecture decisions can be created quickly with AI support, but remain difficult to follow and scattered across Markdown files – knowledge is lost as soon as it is no longer in the context window. arknet turns requirements engineering and architecture knowledge into structured, verifiable data instead of plain text: requirements, use cases, and architecture decisions form a consistently linked knowledge graph, traceable from requirement to architecture decision – queryable by both people and AI agents. Technically based on RDF/OWL and a custom MCP server.

• Result: Working MCP daemon, Docker image published automatically to GHCR, nine hexagonal modules, eleven ADRs (including an Open-Core licensing model). Requirements engineering and Ubiquitous Language hexagons are active. Public as a Community Edition under Apache-2.0 since 07/2026 (github.com/kogn-io/arknet), together with the Claude Code plugin and GHCR image; Open-Core model.

• Label: Java, Maven, RDF, RDF4J, OWL, SPARQL, Model Context Protocol, Spring AI, Docker, GitHub, Git, Claude Code, Obsidian, DDD, Hexagonal Architecture, ArchUnit, JUnit, AssertJ, Interface Development, Software Architecture, Continuous Integration, Knowledge Management

• Modernization of a large-scale Java enterprise application*

The project is modernizing a complex enterprise application that has grown over many years. The existing Spring-based legacy system runs on Java 8, OSGi, and Eclipse RCP and is being gradually migrated to a modern, maintainable architecture with Java 25 and Quarkus.

Marcus works on analysis, architecture, refactoring, and implementation. One focus is on untangling historically grown structures and dependencies and on building a clean, sustainable Java and Quarkus technology stack.

Tools & technologies: Java 8, Java 25, Quarkus, Hibernate ORM with Panache, EclipseLink, OSGi, Eclipse RCP, Maven, JUnit, Mockito, REST, JSON, Git, Eclipse IDE, IntelliJ IDEA Ultimate, Jira, Confluence

• Optimizing and accelera­tion of our Gitlab CI pipeline

• Conceptual work for the PoC of the Zero Trust system

• Extension of the policy-engine backend in Go

• Extension of the policy-testing mechanism in Python

• Architectural design of the PEP component of Zero Trust

• Documentation of the product

• Technologies: Zero Trust, Go, Python, Gitlab CI, Docker, JWT, Domain-Driven Design

• Led development of 15+ microservices (Java 17, Spring Boot) driving customer interactions; migrated from on-prem to GCP Kubernetes, improving scalability and reducing infra cost by 20%.
• Optimized user services with CouchDB caching and API refactoring, cutting response times by 35% and enhancing customer experience.
• Implemented canary deployments, FluxCD GitOps, and CI/CD optimizations in GitLab, reducing release lead time by 25% and enabling zero-downtime rollouts.
• Set up Grafana health checks and Anodot alerts for latency, error, and throughput monitoring, reducing MTTR by 40%.
• Built secure APIs using OAuth2, DPoP, and Gatekeeper, integrated REST and GraphQL, and achieved 90%+ test coverage with unit and E2E tests.
• Mentored junior developers, promoted Agile best practices, and collaborated cross-functionally to deliver high-impact, reliable customer-facing features.

Full overall responsibility: product, technology, compliance and go-to-market

• Delivered an enterprise MVP in 54 days, exceeding scope and schedule.
• Won a 250k € ARR anchor customer and built a sustainable enterprise sales pipeline in the first quarter.
• Paid PoCs with Zalando (35k €) and tesa (26k €), validating product-market fit with Tier-1 enterprise customers.
• Initiated ISO-27001 and TISAX certification processes. Left when the venture entered its next organizational phase.

Designed and developed an Azure-based AI and data platform transforming distributed project documents into searchable, structured knowledge for an enterprise AI assistant. Combined incremental document processing, hybrid keyword/vector retrieval, knowledge graph extraction, and conversational AI for Microsoft Teams and Microsoft 365 Copilot. Implemented Python document-processing pipelines for PDF, Word, Outlook and text files; Azure Cosmos DB lifecycle management; Azure AI Search; Azure AI Foundry and Azure OpenAI; identity-aware retrieval with Microsoft Entra ID; project authorization; a TypeScript Microsoft Agents SDK agent; Pulumi infrastructure; resilient scheduling, retry and diagnostic tooling. Technology stack: Python, TypeScript, FastAPI, Pydantic, Azure AI Foundry, Azure OpenAI, Azure AI Search, Azure Cosmos DB, Blob/Table Storage, Container Apps/Jobs, Service Bus, Key Vault, Entra ID, Docker, Pulumi, pytest, Microsoft Teams and Microsoft 365 Copilot.