Microsoft Entra ID Experts in Germany

• Creating concepts and architecture for domain integration (SEAT into the VW structure)
• Domain trusts and administration
• Operation and administration of Windows 2022/ 2025 servers and domains
• Domain restructuring
• GPO and SG editing and migration
• DNS restructuring and migration

Technologies: Windows 2022, Active Directory, ADFS, AD Azure Connect, DHCP, DNS, GPO, VMWare vSphere, Hyper-V, Powershell, Jira, MS Office 365,), SCCM, VSAN Fileservices, Approximately 800 servers, 400 users

Management of several MFA methods for centralized authentication within a group. Interface between various stakeholders such as Support, Finance, Developers, and Security departments. Assessment of compliance requirements such as KRITIS. Budget controlling and monitoring of KPIs and SLAs. Support with internal and external audits on MFA topics and with connecting new systems. Review of operational documentation. Participation in steering committees and leadership of service review meetings and decision-making committees.

Tools/Frameworks: FIDO, Yubikey, Veridium, BSI Grundschutz, NIST

Led the end-to-end integration and migration architecture for decommissioning SAP IS-U market communication and transitioning to Salesforce Marketing Cloud (SFMC) with E.ON IT Services — covering regulated EDIFACT market messaging, a three-phase data migration (transfer of market message inventory after cutover), redesign of market communication processes, and full GDPR and German energy-market compliance.

• Designed the three-tier target architecture (SAP IS-U → NScale B2B gateway → SFMC) processing 50,000–100,000 EDIFACT messages daily within sub-5-minute SLAs.
• Architected the three-phase data migration: 36 months of historical data, zero-loss cutover of in-flight market messages, and near-real-time CDC synchronization.
• Delivered secure, BDEW/GDPR-compliant integration (AS2/OFTP2, RFC/IDoc, REST APIs, OAuth 2.0, Azure AD, AWS S3) achieving >99.5% uptime, <0.1% migration discrepancy, and RTO <4 hours.
• Applied BPMN to model and optimize the market communication processes.

Technologies: SAP IS-U, NScale, Salesforce Marketing Cloud, EDIFACT, OAuth 2.0, Azure AD, AWS S3, BPMN, Jira, Confluence, Draw.io

• Engaged within the Information and Security Management division for a Proof of Concept (PoC) project focused on developing a Client Security Portal.
• Managed project resources across the UK, India, and Germany.
• Architected and deployed the PoC solution leveraging a modern Java stack, Google Cloud Platform (GCP) with Kubernetes, and Active Directory (Entra ID) for authentication.
• Implemented OAuth 2.0 for authorization.
• Ensured DORA alignment according to Deutsche Bank security rules and regulatory preparation.

Business analysis / requirements engineering for the introduction of a central authorization platform:

• Analysis of existing requirements for the use of IGA solutions (NetIQ, MidPoint) in an existing IAM cluster
• Capturing requirements as epics and user stories (JIRA) to provide a comprehensive description of the use of an IGA solution for central access control across connected platforms and applications.
• Functional solution descriptions (Confluence) for various lifecycle processes, such as Identity Lifecycle (ILC), Role Lifecycle (RLC), Structure Lifecycle (SLC), and Application Lifecycle
• RBAC: Design of a role model in the IGA solution to automate access provisioning as much as possible, capturing application and business roles
• Approach for onboarding applications to the IGA tool, integrating Keycloak (ID Provider).
• Functions and processes for recertifying entitlement objects and roles, and for assigning / removing them from personalized identities.
• Functions and processes for audit-proof documentation and reporting of managed data and processes in the IGA / IAM environment.
• Planning, execution, and documentation of QA / testing for the 1st implementation phase of the MidPoint IGA solution in the IAM cluster.
• Planning a roadmap for the step-by-step testing and introduction of the IGA solution.

Further Development of the Integrated Capacity Management Platform InKa

Rail Infrastructure

• Power BI shared datasets and reports via DirectQuery on Amazon Redshift (timetable, construction and capacity data)
• Automated report testing with Playwright in Docker containers, version control with GitLab
• Concept and implementation of user communication (information page, changelog, known bugs)

Initial Situation:

The integrated capacity management platform (InKa) is a monitoring and analysis platform for data from timetable and capacity management: customer orders, infrastructure, timetable operations, construction, as well as route capacity and width. The data is stored and linked in a structured data warehouse. This makes it possible to create complex KPIs across different source systems and display current and future route utilization as well as construction activity across the network. The goal is to improve strategic, medium-term and intra-year planning and provide users with easy access to capacity management analyses.

Measures:

• Enablement: Introduction of Power BI with training and workshops for development teams.
• Consulting & Design: Problem analysis, concepts and solution consulting for reporting requirements; implementation of reporting solution plans.
• Data Model: Development of shared datasets with DirectQuery on Amazon Redshift and import tables; DAX measures for utilization and capacity KPIs.
• Development: Data analysis, data transformation and visualization in Power BI; extension and migration of business applications to Power BI; AI-supported development in VS Code with GitHub Copilot.
• Test Automation: Automated testing of Power BI reports with Playwright; setup of the test environment in Docker containers.
• User Communication: Concept and implementation of a central information page with hot news, changelog and known bugs, access from reports with report filters, updates via Power Automate.
• Deployment: Management of Power BI Deployment Pipelines across the DEV, TEST and PROD environments.
• Agile Working: Work in an agile team according to SAFe (Scaled Agile Framework); refinement of user stories and features including effort estimates in Jira; version control with Git and GitLab.
• Quality & Documentation: Reviews for quality assurance, error analysis and resolution, technical documentation in AsciiDoc and Confluence.

Technologies: Power BI, DAX, Power Query, DirectQuery, Amazon Redshift, Git / GitLab, Deployment Pipelines, Playwright, Docker, AsciiDoc, Power Automate, Jira, Confluence, VS Code with GitHub Copilot, SAFe

Results:

• Capacity management KPIs from multiple source systems combined on one platform
• Transparency regarding current and future route utilization and construction activity across the network
• Easy access to analyses for users
• Automated regression testing of Power BI reports
• User communication implemented: central information page with hot news, changelog and known bugs, directly accessible from the reports

• Act as project manager and first point of contact on the project side
• Coordinate with teams to ensure required information is available for project completion
• Ensure both general contractors and internal teams store information correctly
• Monitor compliance with the project checklist and follow-up
• Plan and execute the project plan
• Perform budget and project calculations based on expected price calculations and estimated effort
• Participate in project meetings
• Review progress of Actoom (external partner handling data)
• Answer queries from Actoom regarding data migrations to retrieve data from internal partners or general contractors
• Contact subcontractors to obtain missing information
• Communicate with insolvent companies to obtain missing information

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

• Industry: Insurance, Trade, IT
• Customers & Projects: Consulting and selling insurance and similar services
• Main tasks: Insurance consulting (health insurance, retirement planning, wealth building); commercial services, inside and field sales; sales data analysis and forecasting; customer consulting and support; opening a new sales headquarters for private and business customers; business development & innovation management; business use case development; process optimization; stakeholder management; team leadership and training; preparation and delivery of trainings;
• Technologies used: Microsoft Office 365, Microsoft Teams, Jira, Draw.IO, Camunda 8, Java (8, 17,21,25), Git, Spring Boot, Spring Batch, Spring Data REST, Spring Web, Spring Security, J-Unit, Playwright, Lombock, Vaadin, H2, PostgreSQL (16, 17 18), pgAdmin, Docker, LLMs, JasperSoft Studio, JasperReports

• Designed and moderated a NIS2 preparation workshop for RAS Reinhardt Maschinenbau GmbH and its IT service provider Catuno GmbH. Together with executive management and IT leadership, the current status was assessed, an initial GAP analysis was conducted and areas for action were prioritized based on ISO 27001.
• Developed an ISO-27001-based regulatory framework (ISMS) for NIS2 compliance, including a structured current/target GAP analysis, targeted improvement of the security maturity level and preparation of the organization for NIS2 audit readiness.

• Worked as freelance Senior DevOps Consultant on-site for IBM at a European Union Agency, operating in a highly secure, air-gapped environment managing classified systems.
• Led automation and DevOps initiatives for a large-scale OpenShift platform (>400 nodes), driving deployment efficiency, GitOps adoption, and operational automation using Ansible, Python, and Bash while ensuring compliance with security requirements.
• Spearheaded automation of release and deployment workflows in a private cloud environment hosting 400+ OpenShift nodes, significantly improving deployment speed and reliability.
• Migrated existing playbooks, roles, and templates from Ansible Tower to Ansible Automation Platform (AAP), ensuring full compliance with fully-qualified collection names (FQCN) and preparing custom Execution Environments (EE) for containerized automation.
• Implemented GitOps Agent for AAP Controller Configuration as Code, enabling automated synchronization (CRUD) of Ansible Controller objects based on repository-stored configuration definitions using GitHub webhooks.
• Designed and automated complex multi-step operational workflows including environment cleanup, Helix cluster component re-creation, Kafka topic management, and OpenShift object lifecycle management across ~100 environments.
• Achieved a reduction of multi-day manual operations to under a few hours through automation improvements spanning multiple AAP clusters and OpenShift environments.
• Integrated Ansible Automation Platform with Thycotic (Delinea) Secret Server via lookup plugin to enhance secure credential management in automated processes.
• Managed deployment tasks, platform troubleshooting, and Istio network configurations while adhering to stringent EU PSC security and compliance standards.
• Collaborated with infrastructure and application teams to refine deployment procedures, develop naming conventions, and continuously improve automation coverage in an air-gapped, classified environment.

• Responsible for the backlog and roadmap of a production SaaS compliance platform for the EU Deforestation Regulation (EUDR), with around 30 customers on AWS and Docker.
• Coordinated feature development and API integrations across 2 external and internal development teams.
• API integrations with the EU EUDR API and SAP.
• 70% fewer customer-reported issues, supporting ISO-27001 certification.

• Designed and implemented modular AI assistants for sales and business processes within the Microsoft ecosystem (Agentic AI, Copilot extensions)
• Frontend architecture and development with React + TypeScript for embedded chat and assistant surfaces (streaming UI, Hooks, React Query, OpenAPI clients)
• Enterprise-level agent development: reusable skill/agent library, MCP servers, review and compliance gates
• LLM integration into the user experience: Anthropic (Claude), OpenAI, tool use, RAG pipelines, prompt engineering, guardrails
• Architecture and code review consulting, and mentoring within the AI development team
• Integration with Microsoft Graph, Power Platform, and Azure services
• Technologies: React, TypeScript, Anthropic Claude, OpenAI, MCP, RAG, Microsoft Graph, Power Platform, Azure

• Fully on-premises LLM document-examination platform for a compliance-critical banking domain: agentic LangGraph pipeline with deterministic verification, every AI judgment structured and source-anchored; ~960 automated tests, zero data egress
• GPU throughput engineering (quantized serving, speculative decoding, prefix caching): 9.5x extraction speed-up, 500+ multi-document case files per day on a single A100
• AI-native EDI/EDIFACT integration platform (~116k LOC Java 25 / Spring Boot 4, 1,900+ tests): LLM-drafted partner mappings machine-verified before go-live (DFDL conformance, field-coverage checks, dry runs), ~99.5% byte match on real customer files — replacing weeks of manual mapping per partner