Kerberos Experts in Germany

• Error analysis and fixes including performance optimization of the in-house developed platform API
• Change and incident management in day-to-day operations
• Responsible for compliance with security and compliance requirements
• Vendor management for software development and maintenance
• Planning and execution of migration of legacy services to a cloud native platform

Role in the project: project staff, implementation team

Used skills: requirements analysis, IT service and application management, IT operations, error analysis and performance optimization, software maintenance and lifecycle management

Project environment: Cloud Native Platform (Kubernetes, Crossplane, AWS, ArgoCD, Grafana)

IOG (IOHK), is one of the world's pre-eminent blockchain infrastructure research and engineering companies.

• Converted a lingering R&D project into a cohesive, production-ready testnet; built and scaled the 35-member engineering team (Core, QA, SRE) to achieve this goal.
• Defined strategic direction and aligned technology development with business objectives as a key member of the leadership.
• Optimized software development processes and implemented agile methodologies, enhancing operational efficiency and code security.
• Delivered projects in a fast-paced startup environment through effective project management and resource allocation.

• Migrate company software to RHEL10
• Development in Bash, Python, C, Ansible

• Stabilized the cross-site workplace/printer rollout and transferred it into reliable operational processes. Ongoing hospital operations, new naming conventions, new print servers in a different AD structure, Kerberos dependencies, management systems and inconsistent inventory data.
• Took over technical workstreams and escalated risks at an early stage. Interface between IT operations, project organization, internal employees and external service providers; independently responsible for critical technical workstreams without formal overall project management.
• Fully consolidated the central master/rollout data. Correlated serial number, MAC, IP, location and old/new device references from several sources and established them as a shared working basis for rollout, follow-up work, location and toner processes.
• Technically stabilized the printer rollout. 717 devices in the consolidated rollout scope, including 431 replacement devices; 114 documented deviations. Controlled, created or validated around 2,000 printer/queue objects.
• Proposed Location B as an independent work package and managed it technically. Consolidated 216 old devices into 88 new devices; implemented this in around 10 working days with 1-2 external technicians. Prepared ClearPass, TXT/mapping and ORBIS offset topics in parallel.
• Made several thousand existing TXT/VBS client assignments suitable for bulk migration. Defined old/new mapping, new print servers, Follow-Me, queue, suffix and tray logic; developed checking/correction logic for incorrect manual names.
• Built and productively verified cross-domain FollowMe. Used the historical username attribute to map between the old and new AD domains; stopped further expansion when data quality was no longer reliable.
• Developed the technical approach for hardware/queue reconciliation. Correlated standard lists, print server objects and real devices using IP/SNMP; defined rules for MAC, serial number, IP, location, toner, trays, keep/remove/rename, duplicates and rollback.
• Built AI-assisted automation under time pressure. Developed and stabilized PowerShell/XML tools with independently developed process, data and validation logic, test cases, logging, DryRun/guardrail approaches, error analysis and live validation.
• Designed an HTTP/web platform as a target architecture that was not introduced into production. Technically designed ASP.NET Core 8, .NET Worker, SQLite and PowerShell 5.1 for job control, target/actual comparison, logging/audit, recovery, queueing and locking.
• Operationalized toner, location and operational processes. Consolidated TA-Cockpit location data; established toner/order logic with prioritized run lists; supported Follow-Me, duplex and Scan2Mail pilots.
• Worked out the KRITIS/emergency topic in detail. Structured and visualized printer operations during power/infrastructure failures, coordinated internally and supported the integration into the emergency concept.
• Coordinated the workplace/IGEL client rollout with 1.200+ thin clients from a technical and operational perspective. Prepared the project from 11/2025 and continued it from mid-09/2026. Technically reviewed and structured the process from unpacking and labeling/inventory to setup; handed over operational unpacking/label coordination to a colleague so several employees could work in parallel.
• Personally prepared around 120 thin clients for production. Together with a technical colleague, primarily responsible for finding a solution for automated IGEL-OS-12 installation; productive automation is currently still open.
• Saved around 83 hours of manual ClearPass data entry. Created a PowerShell/import script for ClearPass and demonstrably saved the network colleague around 83 hours of manual entry for 1.200 thin clients; at the same time, significantly reduced the risk of manual errors.
• Supplied formal project management with technical results. Operational results, technical feasibility, process structure and status from the responsible workstreams serve as an important basis for steering by the official project manager.
• Documentation & handover. Documented rollout, AQrate, TA-Cockpit and automation processes, conducted training and tested, configured and prepared around 25 digital medical carts for operation.

• Planned and implemented new network infrastructure (VLAN, LACP, DMZ, structured cabling)
• Migrated from VMware to KVM using Oracle Linux Virtualization Manager (OLVM), including CPU pinning
• Hardened the entire environment using SELinux (KVM hosts, container hosts, database servers)
• Configured and operated the virtualization platform with OLVM and Ansible-based provisioning
• Containerized and redeployed critical services: WordPress, Jenkins, PostgreSQL, MariaDB, Subversion with Apache + AD integration
• Developed Ansible playbooks for automated deployment and configuration management
• Integrated Foreman for repository and security management in the DMZ
• Produced technical documentation in Markdown; organized in Bookstack
• Coordinated with external vendors (e.g. HPE) for hardware installation and setup
• Delivered all contributions documented and reproducible in Markdown

• As part of the project, I was responsible for operating a Citrix farm for 600 users, including optimizing the user experience and ensuring high availability.

• I managed and optimized the entire application landscape of a major customer, evaluated and implemented application updates, and ensured the compatibility and security of the software in use.

• I managed user accounts, implemented security policies, and monitored system performance.

• I administered Azure Entra ID to control identities and access rights, implemented security policies, and synchronized on-premises directories with the cloud.

• I implemented and managed Microsoft Intune for central management of client devices, including the configuration and management of BitLocker for disk encryption.

• I managed file servers and NTFS permissions to ensure secure and efficient data access management.

• I handled change requests and last-level support tickets efficiently to solve complex system issues and improve user satisfaction.

• I supported and advised the customer team on various topics and projects, identified areas for improvement, and implemented best practices.

Technologies used:

• Citrix XenApp and XenDesktop
• Microsoft Windows Server 2012R2 and 2022
• Exchange 2016 and Exchange Online
• Entra ID (Azure AD)
• Entra ID Connect
• BitLocker
• PowerShell scripting
• Microsoft Intune
• LDAP (Lightweight Directory Access Protocol)
• DNS services (Domain Name System)
• Active Directory Certificate Services (AD CS)

• Installation, planning, maintenance and further development of the server farm in the area of hardware and software
• Migration of live systems with minimized downtime
• Processing tickets and changes in daily business
• Documentation of changes and processes in Confluence
• Test runs in the development environment
• Configuration and administration of Linux systems
• Configuration and administration of backup systems (Dell Networker, DataDomain)
• Administration of the Checkpoint firewall

• Bootstrapping a CloudOps team and building a multi-cloud provider backend for a low-code Internal Developer Platform (IDP) with env zero

• Introducing user story mapping, ADRs, milestones, and backlog management

• Designing and developing core APIs, setting up CI/CD pipelines, OpenTofu/Terraform scripts

• Representing and communicating the team with third-party stakeholders (e.g. env zero)

• (Cross-)team coaching on DevOps, software design, Terraform, Golang, and agile practices

• Analysis and further development of the security architecture.
• Design and development of Splunk apps and technical add-ons (TAs).
• Development and implementation of security use cases in the Splunk SIEM.
• Creation and maintenance of incident response playbooks in Cortex XSOAR.
• Support of technical proof-of-concepts to assess new detection technologies.
• Lifecycle management and operational support for Splunk and Cribl systems.
• Deployment and scaling of Splunk indexers in hybrid data center environments.
• Maintenance, update planning, and optimization of Cribl Stream & Edge for log ingestion and data routing.
• Creation of dashboards and reports to visualize security posture and system availability.
• Technical analysis to assess network topologies and data flows.
• Integration of new data sources via Cribl Stream/Edge and heavy forwarders in cloud and on-prem environments.
• Integration of external security components such as Cortex XSOAR (SOAR) and user behavior analytics (UBA).
• Implementation of complex correlation rules in Splunk Enterprise Security (ES).
• Connection of external ticketing systems via mail gateways and REST APIs.
• Automated deployment of use cases, dashboards, and detection rules via Git and Ansible.

Restructuring email authentication across the entire domain inventory of an international industrial company with 1,000 to 5,000 users: around 45 domains in more than 20 countries.

• Inventory of all domains and classification as sending, non-sending, or unclear; target design for each domain group
• DMARC reporting (rua) as the data basis before any policy tightening, with aggregate reports analyzed over several weeks
• SPF lookup budget (limit of 10 lookups) counted rather than estimated; several assumptions from previous findings were thus disproved
• Analysis of the multi-stage mail flow across on-premises Exchange, Microsoft 365, and security gateways, and its impact on DKIM alignment and SPF
• Assessment of external findings based on evidence: confirmed, false positive, or context-dependent, with justified disagreement presented to the assessor
• Change proposals with before/after state, risk, and rollback; implementation is handled by the customer
• Tenant-to-tenant migration analysis for a group company: read-only audit, technical assessment, management summary, migration paths
• Analysis of a service shared mailbox according to CISO and data protection requirements: anonymized in the transformation layer, without personal data analysis

Technologies: Exchange Online, Exchange Hybrid, Entra ID, Microsoft Graph, PowerShell, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, Power BI

• Subproject Manager / Head of Monitoring for facility management and handling operational project parts as well as coordinating operations
• CheckMK consulting: central monitoring infrastructure with CheckMK master and distributed CheckMK satellites
• Implementation of advanced monitoring approaches, integration of new plugins and customization of the CheckMK agent
• Graphic representation of performance metrics with InfluxDB and Grafana, creation of NagVis/Grafana templates and dashboards
• Monitoring of Linux/UNIX/Windows systems and active components using CheckMK agents/MRPE as well as hardware monitoring via SNMP
• Development of monitoring plugins based on Bash scripting
• Inventory and cross-disciplinary analysis for application-specific monitoring
• Concept design, testing and documentation for integrating CheckMK status messages and performance data into a higher-level umbrella system (Data Leak)
• Technical and conceptual point of contact

• Tribe Home, Product Area 4 - Customer in Life, Squad Cybertron.
• Analysis, design, development, and testing of new requirements for Optimmo, construction financing software.
• Analysis, design, development, and testing of the JEE application MWS kredit-baufi.
• Analysis, design, development, and testing of the Wicket Optimmo application.
• Analysis, design, development, and testing of kredit-baufi batch programs.
• Migration of kredit-baufi batches to RHEL9.
• CiL SCS Consumer Pacts with Finagle.
• CiL ScS Touch Point Architecture Integration.
• Team size: 10.
• Tools / Frameworks: OpenJDK Java 17, Kotlin 1.6.0, Azure, Jenkins, Stash, JEE, Gitlab, JIRA, Confluence, git, Spring 6.0, Sping Cloud, Spring Data, Hibernate, JPA, JMS, Kafka, Oracle, PL/SQL, Red Hat Enterprise Linux (RHEL), Maven, REST, JBoss, Intellij IDEA, Wicket 9 and 10, Istio.

• Developed a comprehensive business concept for a medical fall detection device based on a patented process registered in Germany
• Identified and collected use cases for medical device deployment in residential buildings and healthcare provider facilities
• Expanded the product scope to industry standards such as HL7/FHIR and designed a product based on modern communication protocols for IIoT
• Supported offshoring activities, defined SLA and scope-of-work documents for development teams after selecting various vendors
• Identified and selected hardware components (Terrabee, E-Con Systems) for LIDAR/TDOA functions
• Defined integrated AI features and LLM models for patient fall detection as well as AI-based audio triggers
• Oversaw the implementation of algorithms for object detection, fall detection, and false alarm identification

• Skills: ACLs, Android, Ansible, Apache, Backup, Bash, BindFS, Modern C++, CFEngine, ClusterSSH, CSS, CUPS, Debian, DHCP, DNS, dovecot, exim4, Firewall, FUSE, GIMP, Git, gnupg, HTML, IMAP, IPv4, Kerberos, LDAP, LineageOS, Linux, Mercurial, NAT, Networking, NFSv4, OpenPGP, OpenSSH, OpenSSL, OpenVPN, PHP, pxelinux, Python, RAID, Responsive Web Design, Routing, Shorewall, SMTP, SSHFS, SSL/TLS, systemd, TFTP, UPS, VPN, X11, XMPP