Microsoft Entra ID Expert

• Creating concepts and architecture for domain integration (SEAT into the VW structure)
• Domain trusts and administration
• Operation and administration of Windows 2022/ 2025 servers and domains
• Domain restructuring
• GPO and SG editing and migration
• DNS restructuring and migration

Technologies: Windows 2022, Active Directory, ADFS, AD Azure Connect, DHCP, DNS, GPO, VMWare vSphere, Hyper-V, Powershell, Jira, MS Office 365,), SCCM, VSAN Fileservices, Approximately 800 servers, 400 users

Management of several MFA methods for centralized authentication within a group. Interface between various stakeholders such as Support, Finance, Developers, and Security departments. Assessment of compliance requirements such as KRITIS. Budget controlling and monitoring of KPIs and SLAs. Support with internal and external audits on MFA topics and with connecting new systems. Review of operational documentation. Participation in steering committees and leadership of service review meetings and decision-making committees.

Tools/Frameworks: FIDO, Yubikey, Veridium, BSI Grundschutz, NIST

• Integrated highly regulated countries such as China and South Korea into a company-wide M365 tenant.

• Technical point of contact for integrating specific requirements for the board and German subsidiaries subject to BaFin compliance requirements.

• Subproject management.

• Coordinated requirements as part of the overall architecture.

• Designed the use of DLP features from Microsoft Purview.

• Designed special access restrictions using Entra Id Conditional Access.

• Supported the design of provisioning Teams teams and SharePoint sites with enhanced compliance requirements.

• Provided technical support for implementing information classification with Sensitivity Labels for SharePoint Online and Teams.

• Provided technical support to the subproject for introducing CoPilot for M365.

• Skills: M365, Purview, DLP, Entra Id, Sensitivity Labels, CoPilot, Teams, SharePoint Online.

Led the end-to-end integration and migration architecture for decommissioning SAP IS-U market communication and transitioning to Salesforce Marketing Cloud (SFMC) with E.ON IT Services — covering regulated EDIFACT market messaging, a three-phase data migration (transfer of market message inventory after cutover), redesign of market communication processes, and full GDPR and German energy-market compliance.

• Designed the three-tier target architecture (SAP IS-U → NScale B2B gateway → SFMC) processing 50,000–100,000 EDIFACT messages daily within sub-5-minute SLAs.
• Architected the three-phase data migration: 36 months of historical data, zero-loss cutover of in-flight market messages, and near-real-time CDC synchronization.
• Delivered secure, BDEW/GDPR-compliant integration (AS2/OFTP2, RFC/IDoc, REST APIs, OAuth 2.0, Azure AD, AWS S3) achieving >99.5% uptime, <0.1% migration discrepancy, and RTO <4 hours.
• Applied BPMN to model and optimize the market communication processes.

Technologies: SAP IS-U, NScale, Salesforce Marketing Cloud, EDIFACT, OAuth 2.0, Azure AD, AWS S3, BPMN, Jira, Confluence, Draw.io

• Engaged within the Information and Security Management division for a Proof of Concept (PoC) project focused on developing a Client Security Portal.
• Managed project resources across the UK, India, and Germany.
• Architected and deployed the PoC solution leveraging a modern Java stack, Google Cloud Platform (GCP) with Kubernetes, and Active Directory (Entra ID) for authentication.
• Implemented OAuth 2.0 for authorization.
• Ensured DORA alignment according to Deutsche Bank security rules and regulatory preparation.

Business analysis / requirements engineering for the introduction of a central authorization platform:

• Analysis of existing requirements for the use of IGA solutions (NetIQ, MidPoint) in an existing IAM cluster
• Capturing requirements as epics and user stories (JIRA) to provide a comprehensive description of the use of an IGA solution for central access control across connected platforms and applications.
• Functional solution descriptions (Confluence) for various lifecycle processes, such as Identity Lifecycle (ILC), Role Lifecycle (RLC), Structure Lifecycle (SLC), and Application Lifecycle
• RBAC: Design of a role model in the IGA solution to automate access provisioning as much as possible, capturing application and business roles
• Approach for onboarding applications to the IGA tool, integrating Keycloak (ID Provider).
• Functions and processes for recertifying entitlement objects and roles, and for assigning / removing them from personalized identities.
• Functions and processes for audit-proof documentation and reporting of managed data and processes in the IGA / IAM environment.
• Planning, execution, and documentation of QA / testing for the 1st implementation phase of the MidPoint IGA solution in the IAM cluster.
• Planning a roadmap for the step-by-step testing and introduction of the IGA solution.

Further Development of the Integrated Capacity Management Platform InKa

Rail Infrastructure

• Power BI shared datasets and reports via DirectQuery on Amazon Redshift (timetable, construction and capacity data)
• Automated report testing with Playwright in Docker containers, version control with GitLab
• Concept and implementation of user communication (information page, changelog, known bugs)

Initial Situation:

The integrated capacity management platform (InKa) is a monitoring and analysis platform for data from timetable and capacity management: customer orders, infrastructure, timetable operations, construction, as well as route capacity and width. The data is stored and linked in a structured data warehouse. This makes it possible to create complex KPIs across different source systems and display current and future route utilization as well as construction activity across the network. The goal is to improve strategic, medium-term and intra-year planning and provide users with easy access to capacity management analyses.

Measures:

• Enablement: Introduction of Power BI with training and workshops for development teams.
• Consulting & Design: Problem analysis, concepts and solution consulting for reporting requirements; implementation of reporting solution plans.
• Data Model: Development of shared datasets with DirectQuery on Amazon Redshift and import tables; DAX measures for utilization and capacity KPIs.
• Development: Data analysis, data transformation and visualization in Power BI; extension and migration of business applications to Power BI; AI-supported development in VS Code with GitHub Copilot.
• Test Automation: Automated testing of Power BI reports with Playwright; setup of the test environment in Docker containers.
• User Communication: Concept and implementation of a central information page with hot news, changelog and known bugs, access from reports with report filters, updates via Power Automate.
• Deployment: Management of Power BI Deployment Pipelines across the DEV, TEST and PROD environments.
• Agile Working: Work in an agile team according to SAFe (Scaled Agile Framework); refinement of user stories and features including effort estimates in Jira; version control with Git and GitLab.
• Quality & Documentation: Reviews for quality assurance, error analysis and resolution, technical documentation in AsciiDoc and Confluence.

Technologies: Power BI, DAX, Power Query, DirectQuery, Amazon Redshift, Git / GitLab, Deployment Pipelines, Playwright, Docker, AsciiDoc, Power Automate, Jira, Confluence, VS Code with GitHub Copilot, SAFe

Results:

• Capacity management KPIs from multiple source systems combined on one platform
• Transparency regarding current and future route utilization and construction activity across the network
• Easy access to analyses for users
• Automated regression testing of Power BI reports
• User communication implemented: central information page with hot news, changelog and known bugs, directly accessible from the reports

• Documented complex financial reporting processes in deep-dive sessions with subject matter experts
• Analyzed and mapped the 3-tier data flow SAP – Essbase – HQ (984 account entries, triple chart of accounts)
• Identified the biggest time drains (40 % of close time)
• Evaluated technologies (AWS, Microsoft Fabric, Custom/Hybrid) with cost-benefit analysis
• Created a validation rule catalog with 351 rules as the basis for pre-submission automation
• Business case: estimated savings potential of 480–960 T€/year for the EAR region
• Hands-on implementation with Microsoft Fabric, RAG, AI agents/Tool Calling and n8n; productive use of Microsoft Copilot and Copilot Studio
• AI-supported project management workflows (minutes, tasks, knowledge synchronization)
• Stakeholder management at senior management level (EAR Accounting, IEA IT, TFSC Japan), workshops and training on AI tools

Technologies: Microsoft Fabric, Copilot Studio, Claude AI, Python, Power BI, SAP, Essbase/SmartView, Excel (VBA), Notion, SharePoint

• Standardization and further development
• Application monitoring
• Incident handling
• Change management
• Interface and integration operations
• Testing, acceptance and transition to operations

Task: Operator development and observability

Technologies and skills: Kubernetes, Valkey-Operator, Crossplane, Backstage, OpenPortal, OTEL, Grafana Cloud, Azure DevOps, Artifactory, Flux, Alloy, Prometheus, Grafana, Loki, OCF, Copilot

What I did:

• Evaluated/developed Valkey-Operator
• Set up OpenTelemetry
• Integrated it with OpenPortal/Backstage/CrossPlane

• Act as project manager and first point of contact on the project side
• Coordinate with teams to ensure required information is available for project completion
• Ensure both general contractors and internal teams store information correctly
• Monitor compliance with the project checklist and follow-up
• Plan and execute the project plan
• Perform budget and project calculations based on expected price calculations and estimated effort
• Participate in project meetings
• Review progress of Actoom (external partner handling data)
• Answer queries from Actoom regarding data migrations to retrieve data from internal partners or general contractors
• Contact subcontractors to obtain missing information
• Communicate with insolvent companies to obtain missing information

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

• Industry: Insurance, Trade, IT
• Customers & Projects: Consulting and selling insurance and similar services
• Main tasks: Insurance consulting (health insurance, retirement planning, wealth building); commercial services, inside and field sales; sales data analysis and forecasting; customer consulting and support; opening a new sales headquarters for private and business customers; business development & innovation management; business use case development; process optimization; stakeholder management; team leadership and training; preparation and delivery of trainings;
• Technologies used: Microsoft Office 365, Microsoft Teams, Jira, Draw.IO, Camunda 8, Java (8, 17,21,25), Git, Spring Boot, Spring Batch, Spring Data REST, Spring Web, Spring Security, J-Unit, Playwright, Lombock, Vaadin, H2, PostgreSQL (16, 17 18), pgAdmin, Docker, LLMs, JasperSoft Studio, JasperReports

Goal:

Protect customer domains from spoofing by establishing and securing DMARC compliance, and ensure secure and stable operation of the Exchange and Microsoft 365 environment while keeping legitimate mail flows running smoothly.

Responsibilities:

• Project management, including reporting, customer coordination and budget responsibility
• Set up and secure DMARC, including DKIM and SPF
• Ongoing analysis of DMARC reports to detect and resolve issues early
• Replace EWS connections before Microsoft's shutdown on 01.10.2026 by switching to Microsoft Graph
• Introduce sensitivity labels in Microsoft Purview to protect sensitive information
• Automate recurring administrative tasks with PowerShell
• 3rd Level Support and ongoing administration of Exchange Online and Exchange on-premises

Technologies: Exchange Online, Exchange Server (on-premises), Microsoft 365, Microsoft Graph API, EWS, Microsoft Purview / Sensitivity Labels, DMARC, DKIM, SPF, RUA-Reporting, PowerShell, HCL Notes